CVE-2026-40109: CWE-287: Improper Authentication in fluxcd notification-controller
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.
AI Analysis
Technical Summary
The fluxcd notification-controller's gcr Receiver type prior to version 1.8.3 fails to validate the email claim in Google OIDC tokens used for Pub/Sub push authentication. This flaw allows any valid Google-issued token to authenticate against the Receiver webhook endpoint if the attacker knows the webhook URL. The webhook URL is generated using a hash of a random token and other parameters stored securely in Kubernetes Secrets, making discovery difficult without cluster access or leaked information. Upon authentication, the controller triggers reconciliations for resources specified in the Receiver configuration. However, because Flux reconciliations are idempotent and deduplicated, repeated or unauthorized triggers generally have limited practical impact. The vulnerability is resolved in version 1.8.3.
Potential Impact
An attacker who obtains the Receiver webhook URL and uses any valid Google-issued token can trigger unauthorized Flux reconciliations. These reconciliations are idempotent and deduplicated, so they typically do not alter the cluster state if the desired configuration has not changed. There is no direct confidentiality, availability, or integrity impact beyond triggering these reconciliations. The difficulty in discovering the webhook URL limits exploitation opportunities.
Mitigation Recommendations
Upgrade fluxcd notification-controller to version 1.8.3 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, no additional mitigation steps are required. If upgrading is not immediately possible, ensure that the Receiver webhook URL and associated Kubernetes Secrets are protected to prevent unauthorized access. Patch status is not explicitly stated beyond the fix in 1.8.3; check the vendor advisory for any updates.
CVE-2026-40109: CWE-287: Improper Authentication in fluxcd notification-controller
Description
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The fluxcd notification-controller's gcr Receiver type prior to version 1.8.3 fails to validate the email claim in Google OIDC tokens used for Pub/Sub push authentication. This flaw allows any valid Google-issued token to authenticate against the Receiver webhook endpoint if the attacker knows the webhook URL. The webhook URL is generated using a hash of a random token and other parameters stored securely in Kubernetes Secrets, making discovery difficult without cluster access or leaked information. Upon authentication, the controller triggers reconciliations for resources specified in the Receiver configuration. However, because Flux reconciliations are idempotent and deduplicated, repeated or unauthorized triggers generally have limited practical impact. The vulnerability is resolved in version 1.8.3.
Potential Impact
An attacker who obtains the Receiver webhook URL and uses any valid Google-issued token can trigger unauthorized Flux reconciliations. These reconciliations are idempotent and deduplicated, so they typically do not alter the cluster state if the desired configuration has not changed. There is no direct confidentiality, availability, or integrity impact beyond triggering these reconciliations. The difficulty in discovering the webhook URL limits exploitation opportunities.
Mitigation Recommendations
Upgrade fluxcd notification-controller to version 1.8.3 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, no additional mitigation steps are required. If upgrading is not immediately possible, ensure that the Receiver webhook URL and associated Kubernetes Secrets are protected to prevent unauthorized access. Patch status is not explicitly stated beyond the fix in 1.8.3; check the vendor advisory for any updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-09T01:41:38.536Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d818301cc7ad14da2455d9
Added to database: 4/9/2026, 9:20:48 PM
Last enriched: 4/17/2026, 11:44:30 AM
Last updated: 5/24/2026, 11:39:21 PM
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.