CVE-2026-23990: Impersonation Bypass in Flux Operator

The primary impact of CVE-2026-23990 is the potential for unauthorized access and privilege escalation within a Kubernetes cluster. An attacker who can craft a malicious OIDC token with empty claims can bypass impersonation restrictions, effectively masquerading as another user or service account. This could enable them to modify Git repositories, deploy malicious applications, or compromise sensitive data managed by Flux Operator. The blast radius extends to any resources managed by Flux Operator, as the attacker could potentially manipulate the GitOps workflow to achieve their objectives. This vulnerability highlights the importance of robust authentication and authorization mechanisms in GitOps deployments.

1. Reserved2026-01-19
2. Published2026-02-02
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-23990 is to upgrade Flux Operator to version 0.40.0 or later, which includes the fix for this impersonation bypass. If upgrading is not immediately feasible, consider implementing stricter OIDC claim validation within your Kubernetes environment. This could involve configuring your OIDC provider to enforce specific claim requirements or implementing custom admission controllers to reject tokens with empty claims. Regularly review and audit your Flux Operator configuration to ensure that impersonation restrictions are properly enforced. After upgrading, confirm the fix by attempting to trigger an impersonation flow with a crafted OIDC token containing empty claims; the request should be rejected.