Skip to content
OpenAdvisories

Vendor

fluxcd

10 known vulnerabilities.

Products

flux2 6 source-controller 2 notification-controller 1 kustomize-controller 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.7
    CVE-2022-36049

    Flux2 Helm Controller denial of service

    Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A …

    fluxcd flux2 github.com/fluxcd/flux2 github.com/fluxcd/helm-controller Go
  • High 7.7
    CVE-2022-36035

    Flux CLI Workload Injection

    Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster v…

    fluxcd flux2 github.com/fluxcd/flux2 Go
  • High 7.7
    CVE-2022-24878

    Improper path handling in Kustomization files allows for denial of service

    Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated …

    fluxcd flux2 github.com/fluxcd/flux2 github.com/fluxcd/kustomize-controller Go
  • High 8.8
    CVE-2021-41254

    Privilege escalation to cluster admin on multi-tenant environments

    kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and…

    fluxcd kustomize-controller github.com/fluxcd/kustomize-controller Go