Flux Operator Web UI 冒充绕过漏洞，由于 github.com/controlplaneio-fluxcd/flux-operator 中 OIDC claims 为空

此漏洞的影响是严重的，因为它允许未经授权的用户获得对集群的访问权限。攻击者可以利用此漏洞执行各种恶意操作，例如修改配置、部署恶意应用程序或窃取敏感数据。由于 Flux Operator 通常用于自动化 Kubernetes 集群的配置和部署，因此该漏洞可能导致广泛的破坏。攻击者可以利用此漏洞完全控制受影响的集群，并可能影响到集群中的所有应用程序和服务。该漏洞的利用方式类似于其他身份验证绕过漏洞，攻击者需要能够发送 OIDC 断言，并利用空断言绕过身份验证。

Organizations utilizing Flux Operator for GitOps deployments, particularly those relying on OIDC for authentication, are at risk. Shared Kubernetes clusters where multiple teams or applications share resources are especially vulnerable, as a compromised account could potentially impact a wider range of deployments. Legacy Flux Operator configurations with relaxed OIDC claim validation are also at increased risk.

• linux / server: Examine auditd logs for authentication attempts using OIDC tokens. Look for patterns indicating empty claims being accepted.

auditctl -l | grep -i oidc

• go / platform: Monitor Flux Operator logs for errors related to OIDC claim validation.

// Example: Check for empty claims in your OIDC validation logic
if claims.Subject == "" || claims.Groups == nil { // Add more checks as needed
  return nil, errors.New("Invalid OIDC claims")
}

• generic web: If Flux Operator exposes a management API, test authentication with a crafted OIDC token containing empty claims to verify the impersonation bypass is prevented after patching.

1. 2026-02-02Disclosure

   disclosure

1. 已保留2026-01-19
2. 发布日期2026-02-02
3. 修改日期2026-02-04
4. EPSS 更新日期2026-03-23

缓解此漏洞的最佳方法是升级至 Flux Operator 0.40.0 或更高版本。如果无法立即升级，可以考虑实施一些临时缓解措施。例如，可以配置 OIDC 提供程序以拒绝空断言。此外，可以审查 Flux Operator 的访问控制策略，以确保只有授权用户才能访问敏感资源。如果升级过程中出现问题，可以考虑回滚到之前的稳定版本，并仔细检查升级过程中的配置更改。建议在升级前备份集群配置，以便在出现问题时可以快速恢复。