fluxcd vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20226
3. 20241
4. 20262

Newest CVEs

• CVE-2026-47680

  Source controller: Improper path handling allows traversal

  fluxcd · source-controller

  Medium5.3
• CVE-2026-40109

  Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

  fluxcd · notification-controller

  Low3.1
• CVE-2024-31216

  source-controller leaks theAzure Storage SAS token into logs on connection errors

  fluxcd · source-controller

  Medium5.1
• CVE-2022-39272

  Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

  fluxcd · flux2

  Medium5.0
• CVE-2022-36049

  Flux2 Helm Controller denial of service

  fluxcd · flux2

  High7.7
• CVE-2022-36035

  Flux CLI Workload Injection

  fluxcd · flux2

  High7.7
• CVE-2022-24878

  Improper path handling in Kustomization files allows for denial of service

  fluxcd · flux2

  High7.7
• CVE-2022-24877

  Improper path handling in kustomization files allows path traversal

  fluxcd · flux2

  Critical9.9
• CVE-2022-24817

  Improper kubeconfig validation allows arbitrary code execution

  fluxcd · flux2

  Critical9.9
• CVE-2021-41254

  Privilege escalation to cluster admin on multi-tenant environments

  fluxcd · kustomize-controller

  High8.8