Skip to content
OpenAdvisories

Package · Go

github.com/fluxcd/notification-controller

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2026-40109

    Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

    Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub …

    fluxcd notification-controller github.com/fluxcd/notification-controller Go