Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator

The vulnerability allows an attacker to bypass impersonation controls within the Flux Operator Web UI. This means an attacker who can craft a malicious OIDC token with empty claims can potentially gain unauthorized access to Kubernetes resources managed by Flux. The scope of impact depends on the permissions granted to the impersonated user. A successful exploit could lead to unauthorized deployments, modifications to existing configurations, or even complete control over the Kubernetes cluster if the impersonated user has sufficient privileges. This is particularly concerning in environments where Flux is used to manage critical infrastructure.

Organizations utilizing Flux Operator for GitOps deployments, particularly those relying on OIDC for authentication, are at risk. Shared Kubernetes clusters where multiple teams or applications share resources are especially vulnerable, as a compromised account could potentially impact a wider range of deployments. Legacy Flux Operator configurations with relaxed OIDC claim validation are also at increased risk.

• linux / server: Examine auditd logs for authentication attempts using OIDC tokens. Look for patterns indicating empty claims being accepted.

auditctl -l | grep -i oidc

• go / platform: Monitor Flux Operator logs for errors related to OIDC claim validation.

// Example: Check for empty claims in your OIDC validation logic
if claims.Subject == "" || claims.Groups == nil { // Add more checks as needed
  return nil, errors.New("Invalid OIDC claims")
}

• generic web: If Flux Operator exposes a management API, test authentication with a crafted OIDC token containing empty claims to verify the impersonation bypass is prevented after patching.

1. 2026-02-02Disclosure

   disclosure

1. Reserviert2026-01-19
2. Veröffentlicht2026-02-02
3. Geändert2026-02-04
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade Flux Operator to version 0.40.0 or later, which includes a fix for this impersonation bypass. If immediate upgrading is not possible, consider implementing stricter OIDC claim validation within your authentication provider. This might involve configuring your OIDC provider to always return at least minimal claims, preventing the creation of tokens with empty claims. Additionally, review and restrict the permissions granted to impersonated users within Flux to limit the potential blast radius of a successful attack. After upgrading, confirm the fix by attempting to authenticate with a crafted OIDC token containing empty claims; the authentication should fail.