CVE-2026-40109: CWE-287: Improper Authentication in fluxcd notification-controller
CVE-2026-40109 is an improper authentication vulnerability in fluxcd notification-controller versions prior to 1. 8. 3. The gcr Receiver type does not validate the email claim in Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against the Receiver webhook endpoint if the attacker knows the webhook URL. The webhook URL is difficult to discover without cluster access or leaked secrets. Successful exploitation triggers unauthorized Flux reconciliations, but these are idempotent and typically have no effect if the desired state has not changed. This vulnerability is fixed in version 1. 8. 3.
AI Analysis
Technical Summary
The fluxcd notification-controller's gcr Receiver type prior to version 1.8.3 fails to validate the email claim in Google OIDC tokens used for authenticating Pub/Sub push requests. This improper authentication (CWE-287) allows any valid Google-issued token to authenticate against the Receiver webhook endpoint, provided the attacker knows the webhook URL, which is generated as a hash of a secret token and other parameters. The webhook URL is not publicly enumerable and requires access to Kubernetes secrets or other means to obtain. Upon authentication, the controller triggers reconciliations of specified resources. However, because Flux reconciliations are idempotent and deduplicated, the practical impact is limited. The vulnerability is addressed in fluxcd notification-controller version 1.8.3.
Potential Impact
An attacker who obtains the Receiver webhook URL and uses any valid Google-issued OIDC token can trigger unauthorized reconciliations in the fluxcd notification-controller. These reconciliations are idempotent and deduplicated, so they do not alter cluster state if the desired state has not changed. There is no confidentiality or availability impact reported. The overall impact is limited to triggering no-op reconciliations, classified as low severity with a CVSS score of 3.1.
Mitigation Recommendations
Upgrade fluxcd notification-controller to version 1.8.3 or later, where this improper authentication vulnerability is fixed. Until upgraded, ensure that the Receiver webhook URL and associated Kubernetes secrets are protected and not exposed. There is no official patch link provided, but the vendor advisory confirms the fix in version 1.8.3. No additional mitigation actions are indicated.
CVE-2026-40109: CWE-287: Improper Authentication in fluxcd notification-controller
Description
CVE-2026-40109 is an improper authentication vulnerability in fluxcd notification-controller versions prior to 1. 8. 3. The gcr Receiver type does not validate the email claim in Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against the Receiver webhook endpoint if the attacker knows the webhook URL. The webhook URL is difficult to discover without cluster access or leaked secrets. Successful exploitation triggers unauthorized Flux reconciliations, but these are idempotent and typically have no effect if the desired state has not changed. This vulnerability is fixed in version 1. 8. 3.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The fluxcd notification-controller's gcr Receiver type prior to version 1.8.3 fails to validate the email claim in Google OIDC tokens used for authenticating Pub/Sub push requests. This improper authentication (CWE-287) allows any valid Google-issued token to authenticate against the Receiver webhook endpoint, provided the attacker knows the webhook URL, which is generated as a hash of a secret token and other parameters. The webhook URL is not publicly enumerable and requires access to Kubernetes secrets or other means to obtain. Upon authentication, the controller triggers reconciliations of specified resources. However, because Flux reconciliations are idempotent and deduplicated, the practical impact is limited. The vulnerability is addressed in fluxcd notification-controller version 1.8.3.
Potential Impact
An attacker who obtains the Receiver webhook URL and uses any valid Google-issued OIDC token can trigger unauthorized reconciliations in the fluxcd notification-controller. These reconciliations are idempotent and deduplicated, so they do not alter cluster state if the desired state has not changed. There is no confidentiality or availability impact reported. The overall impact is limited to triggering no-op reconciliations, classified as low severity with a CVSS score of 3.1.
Mitigation Recommendations
Upgrade fluxcd notification-controller to version 1.8.3 or later, where this improper authentication vulnerability is fixed. Until upgraded, ensure that the Receiver webhook URL and associated Kubernetes secrets are protected and not exposed. There is no official patch link provided, but the vendor advisory confirms the fix in version 1.8.3. No additional mitigation actions are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-09T01:41:38.536Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d818301cc7ad14da2455d9
Added to database: 4/9/2026, 9:20:48 PM
Last enriched: 4/9/2026, 9:36:04 PM
Last updated: 4/9/2026, 10:33:10 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.