Fluxcd vulnerabilities

Products

• Flux2 6
• Kustomize-controller 5
• Helm-controller 3
• Source-controller 3
• Notification-controller 2

Newest

• fluxcd source-controller Source controller: Improper path handling allows traversal CVE-2026-47680 Fix available 5.3 MediumJune 5, 2026
• fluxcd notification-controller Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering CVE-2026-40109 Fix available 3.1 LowApril 9, 2026
• fluxcd source-controller source-controller leaks theAzure Storage SAS token into logs on connection errors CVE-2024-31216 Fix available 5.1 MediumMay 15, 2024
• fluxcd flux2, helm-controller, image-automation-controller +4 more +6 more Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration CVE-2022-39272 Fix available 5.0 MediumOctober 19, 2022
• fluxcd flux2, helm-controller, helm +2 more Flux2 Helm Controller denial of service CVE-2022-36049 Fix available 7.7 HighSeptember 7, 2022
• fluxcd flux2 Flux CLI Workload Injection CVE-2022-36035 Fix available 7.7 HighAugust 31, 2022
• fluxcd flux2, kustomize-controller +1 more Improper path handling in Kustomization files allows for denial of service CVE-2022-24878 Fix available 7.7 HighMay 6, 2022
• fluxcd flux2, helm-controller, kustomize-controller +2 more Improper kubeconfig validation allows arbitrary code execution CVE-2022-24817 Fix available 9.9 CriticalMay 6, 2022
• fluxcd flux2, kustomize-controller +1 more Improper path handling in kustomization files allows path traversal CVE-2022-24877 Fix available 9.9 CriticalMay 4, 2022
• fluxcd kustomize-controller Privilege escalation to cluster admin on multi-tenant environments CVE-2021-41254 Fix available 8.8 HighNovember 12, 2021