CVE-2026-40109

{
  "id": "CVE-2026-40109",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T21:16:12.277",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3."
    },
    {
      "lang": "es",
      "value": "Flux notification-controller es el reenviador de eventos y despachador de notificaciones para los controladores de GitOps Toolkit. Antes de la versión 1.8.3, el tipo de receptor gcr en Flux notification-controller no valida la declaración de correo electrónico de los tokens OIDC de Google utilizados para la autenticación push de Pub/Sub. Esto permite que cualquier token válido emitido por Google se autentique contra el endpoint webhook del receptor, lo que desencadena reconciliaciones de Flux no autorizadas. La explotación requiere que el atacante conozca la URL del webhook del receptor. La ruta del webhook se genera como /hook/sha256sum(token+name+namespace), donde el token es una cadena aleatoria almacenada en un Secret de Kubernetes. No hay ninguna API o endpoint que enumere las URL de los webhooks. Un atacante no puede descubrir la ruta sin tener acceso al clúster y permisos para leer el .status.webhookPath del receptor en el namespace objetivo, o sin obtener la URL por otros medios (por ejemplo, secretos filtrados o acceso a la configuración de Pub/Sub). Tras una autenticación exitosa, el controlador desencadena una reconciliación para todos los recursos listados en el .spec.resources del receptor. Sin embargo, el impacto práctico es limitado: la reconciliación de Flux es idempotente, por lo que si el estado deseado en las fuentes configuradas (Git, OCI, Helm) no ha cambiado, la reconciliación resulta en una operación nula sin efecto en el estado del clúster. Además, los controladores de Flux deduplican las solicitudes de reconciliación, por lo que el envío de muchas solicitudes en un corto período resulta en que solo se procesa una única reconciliación. Esta vulnerabilidad está corregida en la versión 1.8.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "fluxcd",
          "product": "notification-controller",
          "versions": [
            {
              "version": "< 1.8.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T20:23:57.726750Z",
          "id": "CVE-2026-40109",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/fluxcd/notification-controller/pull/1279",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w",
      "source": "[email protected]"
    }
  ]
}