CVE-2026-40109
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Low3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Deferred | 3.1 | Low3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.1.
Weakness
Affected products
fluxcd · notification-controller
- affected < 1.8.3
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/fluxcd/notification-controllerGHSA-h9cx-xjg6-5v2w (opens in a new tab)
References (3)
- https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w (opens in a new tab)x_refsource_CONFIRM
- https://github.com/fluxcd/notification-controller/pull/1279 (opens in a new tab)x_refsource_MISC
- https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-h9cx-xjg6-5v2w (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-40109)Record last updated .