{"id":"EUVD-2026-21150","revision":null,"records":[{"revision":"330ce63ce4cd4ec997f2fe2aa6190c30","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40109","aliases":[],"title":"Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering","description":"Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.","state":0,"publishedAt":"2026-04-09T21:06:59.688+00:00","modifiedAt":"2026-04-14T15:02:39.499+00:00","affected":[{"ecosystem":"Vendor product","name":"notification-controller","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"fluxcd\",\n                    \"product\": \"notification-controller\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.8.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","score":3.1,"severity":"LOW"}],"references":["https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w","https://github.com/fluxcd/notification-controller/pull/1279","https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40109","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40109","identifiers":["CVE-2026-40109"]},"retained":false,"historicalAffected":[]},{"revision":"007b9318201a4295a137e981056da1b9","observedAt":"2026-11-01T06:15:15.647+00:00","statement":{"source":"euvd","id":"EUVD-2026-21150","aliases":["CVE-2026-40109","GHSA-h9cx-xjg6-5v2w"],"title":"Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC token…","description":"Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","score":3.1,"severity":null}],"references":["https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w","https://github.com/fluxcd/notification-controller/pull/1279","https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21150","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 9, 2026, 9:06:59 PM","dateUpdated":"Apr 14, 2026, 3:02:39 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-21150","identifiers":["EUVD-2026-21150","CVE-2026-40109","GHSA-h9cx-xjg6-5v2w"]},"retained":false,"historicalAffected":[]},{"revision":"7c59a1c4a0bc4706a167c127ae97d40c","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40109","aliases":[],"title":"Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC token…","description":"Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.","state":0,"publishedAt":"2026-04-09T21:16:12.277+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","score":3.1,"severity":"LOW"}],"references":["https://github.com/fluxcd/notification-controller/pull/1279","https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3","https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40109","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-287","CWE-345"],"productCriteria":[],"sourceDates":{"published":"2026-04-09T21:16:12.277","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40109","identifiers":["CVE-2026-40109"]},"retained":false,"historicalAffected":[]},{"revision":"9d8794391a694e31aec670857d531800","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-h9cx-xjg6-5v2w","aliases":["CVE-2026-40109","GO-2026-5419"],"title":"Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering","description":"### Impact\n\nThe `gcr` Receiver type in Flux notification-controller does not validate the `email` claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations.\n\nExploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as `/hook/sha256sum(token+name+namespace)`, where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's `.status.webhookPath` in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config).\n\nUpon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's `.spec.resources`. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed.\n\n### Patches\n\nThe fix in notification-controller v1.8.3 refactors the GCR Receiver authentication to allow users to extend the verification to `email` and `audience` claims in the JWT. This enables operators to configure their Receiver's secret with the expected GCP Service Account email and audience, which the controller will validate against the token's claims before accepting the request.\n\nEmail validation example:\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: gcr-webhook-token\n  namespace: apps\ntype: Opaque\nstringData:\n  token: <random token>\n  email: <service-account>@<project>.iam.gserviceaccount.com\n  audience: https://<hostname>/hook/<sha256(token+name+namespace)>\n```\n\nFor more information, please see the GCR Receiver documentation: https://fluxcd.io/flux/components/notification/receivers/#gcr\n\n\n### Credits\n\nThanks to Saroj Khadka for reporting this issue to the Flux Security Team.","state":0,"publishedAt":"2026-04-10T20:18:16+00:00","modifiedAt":"2026-06-25T23:11:28.5217957+00:00","affected":[{"ecosystem":"Go","name":"github.com/fluxcd/notification-controller","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w","https://nvd.nist.gov/vuln/detail/CVE-2026-40109","https://github.com/fluxcd/notification-controller/pull/1279","https://github.com/fluxcd/notification-controller","https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"],"sourceUrl":"https://github.com/advisories/GHSA-h9cx-xjg6-5v2w","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h9cx-xjg6-5v2w","identifiers":["GHSA-h9cx-xjg6-5v2w","CVE-2026-40109","GO-2026-5419"]},"retained":false,"historicalAffected":[]},{"revision":"0c1861e4c6724e2c862888ed88fce039","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5419","aliases":["CVE-2026-40109","GHSA-h9cx-xjg6-5v2w"],"title":"Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller","description":"Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-06-25T23:01:09.3762616+00:00","affected":[{"ecosystem":"Go","name":"github.com/fluxcd/notification-controller","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w","https://nvd.nist.gov/vuln/detail/CVE-2026-40109","https://github.com/fluxcd/notification-controller/pull/1279","https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5419","license":"OSV · upstream source license applies","key":"osv:GO-2026-5419","identifiers":["GO-2026-5419","CVE-2026-40109","GHSA-h9cx-xjg6-5v2w"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T15:57:20.8239354+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T15:57:20.8239354+00:00","lastSuccessAt":"2026-11-01T15:57:21.0432994+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:21.0433001+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-f95a49f7991d84fda391d9ec67b41d459e583b1cfe7c441477d04d1fe019c90a","complete":true,"records":417656,"lastAttemptAt":"2026-11-01T15:57:20.2988428+00:00","lastSuccessAt":"2026-11-01T15:57:20.2714671+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.2988428+00:00","snapshotPublishedAt":"2026-11-01T15:25:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-996acc6ac5ed4512972e5675464bd820","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T16:09:37.8504098+00:00","lastSuccessAt":"2026-11-01T16:09:37.846+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:09:37.846+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13449,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T15:57:20.8239354+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T15:57:20.8239354+00:00","lastSuccessAt":"2026-11-01T15:57:21.0444496+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:21.0444501+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f67819536b464ba998dbfc5a485cc684","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T15:57:46.3017893+00:00","lastSuccessAt":"2026-11-01T15:57:46.298+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:46.298+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T15:57:20.6646449+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.6646449+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T15:57:20.4527932+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.4527932+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T15:57:20.7894926+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.7894926+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T15:57:20.5571291+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.5571291+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}