Flux notification-controller GCR रिसीवर में ईमेल सत्यापन की कमी अनधिकृत सुलह (reconciliation) को ट्रिगर करने की अनुमति देती है

The core impact of CVE-2026-40109 lies in the potential for unauthorized Flux reconciliations. An attacker, possessing a valid Google OIDC token (without needing to validate the email claim), can craft a malicious webhook request to the Flux Notification Controller's receiver endpoint. This bypasses the intended authentication mechanism, allowing the attacker to trigger reconciliation loops and potentially modify the desired state of the Kubernetes cluster. The blast radius is limited to the scope of the affected Flux deployment and the resources it manages. While the CVSS score is LOW, the potential for unauthorized configuration changes warrants prompt remediation.

Organizations utilizing Flux Notification Controller for GitOps workflows, particularly those relying on Google Cloud Platform (GCP) for authentication, are at risk. Environments with publicly accessible Receiver webhook endpoints or those lacking robust network segmentation are especially vulnerable.

• kubernetes / server:

kubectl get pods -n flux-system -l app.kubernetes.io/name=notification-controller -o jsonpath='{.items[*].metadata.labels.version}'

• kubernetes / server:

kubectl logs -n flux-system -l app.kubernetes.io/name=notification-controller -c manager | grep -i "oidc token validation"

• generic web: Inspect Flux Notification Controller Receiver webhook endpoints for unusual activity or unexpected reconciliation triggers. Examine Kubernetes audit logs for suspicious API calls related to Flux resources.

1. 2026-04-09Disclosure

   disclosure

1. आरक्षित2026-04-09
2. प्रकाशित2026-04-09
3. संशोधित2026-04-14
4. EPSS अद्यतन2026-04-17

The primary mitigation for CVE-2026-40109 is to upgrade Flux Notification Controller to version 1.8.3 or later, which includes the necessary validation improvements. If an immediate upgrade is not feasible, consider temporarily restricting access to the Receiver webhook endpoint using network policies or firewall rules. Monitor Flux logs for unusual reconciliation activity. While a WAF is unlikely to directly address this, it could be configured to detect and block suspicious webhook requests based on patterns associated with OIDC token manipulation. After upgrading, confirm the fix by attempting to send a test Pub/Sub message with a manipulated OIDC token; the controller should reject the request.