Skip to content
OpenAdvisories

Package · Go

github.com/fluxcd/notification-controller

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.1
    CVE-2026-40109

    Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

    Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub …

    fluxcd notification-controller github.com/fluxcd/notification-controller Go
  • Medium 5.0
    CVE-2022-39272

    Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

    Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provi…

    fluxcd flux2 github.com/fluxcd/flux2 github.com/fluxcd/kustomize-controller Alpine Go