{
  "affected": [
    {
      "affectedData": [
        {
          "product": "notification-controller",
          "vendor": "fluxcd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver\u0027s webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver\u0027s .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver\u0027s .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3."
    },
    {
      "lang": "es",
      "value": "Flux notification-controller es el reenviador de eventos y despachador de notificaciones para los controladores de GitOps Toolkit. Antes de la versi\u00f3n 1.8.3, el tipo de receptor gcr en Flux notification-controller no valida la declaraci\u00f3n de correo electr\u00f3nico de los tokens OIDC de Google utilizados para la autenticaci\u00f3n push de Pub/Sub. Esto permite que cualquier token v\u00e1lido emitido por Google se autentique contra el endpoint webhook del receptor, lo que desencadena reconciliaciones de Flux no autorizadas. La explotaci\u00f3n requiere que el atacante conozca la URL del webhook del receptor. La ruta del webhook se genera como /hook/sha256sum(token+name+namespace), donde el token es una cadena aleatoria almacenada en un Secret de Kubernetes. No hay ninguna API o endpoint que enumere las URL de los webhooks. Un atacante no puede descubrir la ruta sin tener acceso al cl\u00faster y permisos para leer el .status.webhookPath del receptor en el namespace objetivo, o sin obtener la URL por otros medios (por ejemplo, secretos filtrados o acceso a la configuraci\u00f3n de Pub/Sub). Tras una autenticaci\u00f3n exitosa, el controlador desencadena una reconciliaci\u00f3n para todos los recursos listados en el .spec.resources del receptor. Sin embargo, el impacto pr\u00e1ctico es limitado: la reconciliaci\u00f3n de Flux es idempotente, por lo que si el estado deseado en las fuentes configuradas (Git, OCI, Helm) no ha cambiado, la reconciliaci\u00f3n resulta en una operaci\u00f3n nula sin efecto en el estado del cl\u00faster. Adem\u00e1s, los controladores de Flux deduplican las solicitudes de reconciliaci\u00f3n, por lo que el env\u00edo de muchas solicitudes en un corto per\u00edodo resulta en que solo se procesa una \u00fanica reconciliaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.8.3."
    }
  ],
  "id": "CVE-2026-40109",
  "lastModified": "2026-10-26T22:10:00.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40109",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-13T20:23:57.726750Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-09T21:16:12.277",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fluxcd/notification-controller/pull/1279"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}