Vulnerability-Lookup

CVE-2026-40109 (GCVE-0-2026-40109)

Vulnerability from cvelistv5 – Published: 2026-04-09 21:06 – Updated: 2026-04-14 15:02

Title

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Summary

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-13 20:23 UTC

CWE

CWE-287 - Improper Authentication
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7807 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/fluxcd/notification-controller…	x_refsource_CONFIRM
https://github.com/fluxcd/notification-controller…	x_refsource_MISC
https://github.com/fluxcd/notification-controller…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
fluxcd	notification-controller	Affected: < 1.8.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40109",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T20:23:57.726750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T15:02:39.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "notification-controller",
          "vendor": "fluxcd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver\u0027s webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver\u0027s .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver\u0027s .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T21:06:59.688Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w"
        },
        {
          "name": "https://github.com/fluxcd/notification-controller/pull/1279",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fluxcd/notification-controller/pull/1279"
        },
        {
          "name": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"
        }
      ],
      "source": {
        "advisory": "GHSA-h9cx-xjg6-5v2w",
        "discovery": "UNKNOWN"
      },
      "title": "Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40109",
    "datePublished": "2026-04-09T21:06:59.688Z",
    "dateReserved": "2026-04-09T01:41:38.536Z",
    "dateUpdated": "2026-04-14T15:02:39.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40109",
      "date": "2026-11-10",
      "epss": "0.00132",
      "percentile": "0.02827"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "notification-controller",
                "vendor": "fluxcd",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.8.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver\u0027s webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver\u0027s .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver\u0027s .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3."
          },
          {
            "lang": "es",
            "value": "Flux notification-controller es el reenviador de eventos y despachador de notificaciones para los controladores de GitOps Toolkit. Antes de la versi\u00f3n 1.8.3, el tipo de receptor gcr en Flux notification-controller no valida la declaraci\u00f3n de correo electr\u00f3nico de los tokens OIDC de Google utilizados para la autenticaci\u00f3n push de Pub/Sub. Esto permite que cualquier token v\u00e1lido emitido por Google se autentique contra el endpoint webhook del receptor, lo que desencadena reconciliaciones de Flux no autorizadas. La explotaci\u00f3n requiere que el atacante conozca la URL del webhook del receptor. La ruta del webhook se genera como /hook/sha256sum(token+name+namespace), donde el token es una cadena aleatoria almacenada en un Secret de Kubernetes. No hay ninguna API o endpoint que enumere las URL de los webhooks. Un atacante no puede descubrir la ruta sin tener acceso al cl\u00faster y permisos para leer el .status.webhookPath del receptor en el namespace objetivo, o sin obtener la URL por otros medios (por ejemplo, secretos filtrados o acceso a la configuraci\u00f3n de Pub/Sub). Tras una autenticaci\u00f3n exitosa, el controlador desencadena una reconciliaci\u00f3n para todos los recursos listados en el .spec.resources del receptor. Sin embargo, el impacto pr\u00e1ctico es limitado: la reconciliaci\u00f3n de Flux es idempotente, por lo que si el estado deseado en las fuentes configuradas (Git, OCI, Helm) no ha cambiado, la reconciliaci\u00f3n resulta en una operaci\u00f3n nula sin efecto en el estado del cl\u00faster. Adem\u00e1s, los controladores de Flux deduplican las solicitudes de reconciliaci\u00f3n, por lo que el env\u00edo de muchas solicitudes en un corto per\u00edodo resulta en que solo se procesa una \u00fanica reconciliaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.8.3."
          }
        ],
        "id": "CVE-2026-40109",
        "lastModified": "2026-10-26T22:10:00.163",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-40109",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T20:23:57.726750Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-09T21:16:12.277",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/fluxcd/notification-controller/pull/1279"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              },
              {
                "lang": "en",
                "value": "CWE-345"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-04-14T19:23:41+00:00",
      "cve": "CVE-2026-40109",
      "id": "CVE-2026-40109",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40109.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-40109",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-13T20:23:57.726750Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-13T20:24:02.970Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "notification-controller",
              "vendor": "fluxcd",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.8.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver\u0027s webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver\u0027s .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver\u0027s .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287: Improper Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-345",
                  "description": "CWE-345: Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-09T21:06:59.688Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w"
            },
            {
              "name": "https://github.com/fluxcd/notification-controller/pull/1279",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/fluxcd/notification-controller/pull/1279"
            },
            {
              "name": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"
            }
          ],
          "source": {
            "advisory": "GHSA-h9cx-xjg6-5v2w",
            "discovery": "UNKNOWN"
          },
          "title": "Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-40109",
        "datePublished": "2026-04-09T21:06:59.688Z",
        "dateReserved": "2026-04-09T01:41:38.536Z",
        "dateUpdated": "2026-04-14T15:02:39.499Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-40109

Vulnerability from fkie_nvd - Published: 2026-04-09 21:16 - Updated: 2026-10-26 22:10

Severity

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/fluxcd/notification-controller/pull/1279
	security-advisories@github.com	https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3
	security-advisories@github.com	https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "notification-controller",
          "vendor": "fluxcd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver\u0027s webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver\u0027s .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver\u0027s .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3."
    },
    {
      "lang": "es",
      "value": "Flux notification-controller es el reenviador de eventos y despachador de notificaciones para los controladores de GitOps Toolkit. Antes de la versi\u00f3n 1.8.3, el tipo de receptor gcr en Flux notification-controller no valida la declaraci\u00f3n de correo electr\u00f3nico de los tokens OIDC de Google utilizados para la autenticaci\u00f3n push de Pub/Sub. Esto permite que cualquier token v\u00e1lido emitido por Google se autentique contra el endpoint webhook del receptor, lo que desencadena reconciliaciones de Flux no autorizadas. La explotaci\u00f3n requiere que el atacante conozca la URL del webhook del receptor. La ruta del webhook se genera como /hook/sha256sum(token+name+namespace), donde el token es una cadena aleatoria almacenada en un Secret de Kubernetes. No hay ninguna API o endpoint que enumere las URL de los webhooks. Un atacante no puede descubrir la ruta sin tener acceso al cl\u00faster y permisos para leer el .status.webhookPath del receptor en el namespace objetivo, o sin obtener la URL por otros medios (por ejemplo, secretos filtrados o acceso a la configuraci\u00f3n de Pub/Sub). Tras una autenticaci\u00f3n exitosa, el controlador desencadena una reconciliaci\u00f3n para todos los recursos listados en el .spec.resources del receptor. Sin embargo, el impacto pr\u00e1ctico es limitado: la reconciliaci\u00f3n de Flux es idempotente, por lo que si el estado deseado en las fuentes configuradas (Git, OCI, Helm) no ha cambiado, la reconciliaci\u00f3n resulta en una operaci\u00f3n nula sin efecto en el estado del cl\u00faster. Adem\u00e1s, los controladores de Flux deduplican las solicitudes de reconciliaci\u00f3n, por lo que el env\u00edo de muchas solicitudes en un corto per\u00edodo resulta en que solo se procesa una \u00fanica reconciliaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.8.3."
    }
  ],
  "id": "CVE-2026-40109",
  "lastModified": "2026-10-26T22:10:00.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40109",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-13T20:23:57.726750Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-09T21:16:12.277",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fluxcd/notification-controller/pull/1279"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H9CX-XJG6-5V2W

Vulnerability from github – Published: 2026-04-10 20:18 – Updated: 2026-04-10 20:18

Summary

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Details

Impact

The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations.

Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config).

Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed.

Patches

The fix in notification-controller v1.8.3 refactors the GCR Receiver authentication to allow users to extend the verification to email and audience claims in the JWT. This enables operators to configure their Receiver's secret with the expected GCP Service Account email and audience, which the controller will validate against the token's claims before accepting the request.

Email validation example:

apiVersion: v1
kind: Secret
metadata:
  name: gcr-webhook-token
  namespace: apps
type: Opaque
stringData:
  token: <random token>
  email: <service-account>@<project>.iam.gserviceaccount.com
  audience: https://<hostname>/hook/<sha256(token+name+namespace)>

For more information, please see the GCR Receiver documentation: https://fluxcd.io/flux/components/notification/receivers/#gcr

Credits

Thanks to Saroj Khadka for reporting this issue to the Flux Security Team.

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/fluxcd/notification-controller"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40109"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T20:18:16Z",
    "nvd_published_at": "2026-04-09T21:16:12Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nThe `gcr` Receiver type in Flux notification-controller does not validate the `email` claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations.\n\nExploitation requires the attacker to know the Receiver\u0027s webhook URL. The webhook path is generated as `/hook/sha256sum(token+name+namespace)`, where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver\u0027s `.status.webhookPath` in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config).\n\nUpon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver\u0027s `.spec.resources`. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed.\n\n### Patches\n\nThe fix in notification-controller v1.8.3 refactors the GCR Receiver authentication to allow users to extend the verification to `email` and `audience` claims in the JWT. This enables operators to configure their Receiver\u0027s secret with the expected GCP Service Account email and audience, which the controller will validate against the token\u0027s claims before accepting the request.\n\nEmail validation example:\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: gcr-webhook-token\n  namespace: apps\ntype: Opaque\nstringData:\n  token: \u003crandom token\u003e\n  email: \u003cservice-account\u003e@\u003cproject\u003e.iam.gserviceaccount.com\n  audience: https://\u003chostname\u003e/hook/\u003csha256(token+name+namespace)\u003e\n```\n\nFor more information, please see the GCR Receiver documentation: https://fluxcd.io/flux/components/notification/receivers/#gcr\n\n\n### Credits\n\nThanks to Saroj Khadka for reporting this issue to the Flux Security Team.",
  "id": "GHSA-h9cx-xjg6-5v2w",
  "modified": "2026-04-10T20:18:16Z",
  "published": "2026-04-10T20:18:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fluxcd/notification-controller/pull/1279"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fluxcd/notification-controller"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-40109 (GCVE-0-2026-40109)

FKIE_CVE-2026-40109

GHSA-H9CX-XJG6-5V2W

Impact

Patches

Credits

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour