CVE-2026-40109
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Description
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3.
INFO
Published Date :
April 9, 2026, 9:16 p.m.
Last Modified :
Oct. 26, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | LOW | [email protected] |
Solution
- Update Flux notification-controller to version 1.8.3.
- Verify updated Flux notification-controller version.
- Review Receiver configurations for security.
- Restrict access to webhook URLs.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-40109.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-40109 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-40109
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-40109 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-40109 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: notification-controller de fluxcd, Description: Flux notification-controller es el reenviador de eventos y despachador de notificaciones para los controladores de GitOps Toolkit. Antes de la versión 1.8.3, el tipo de receptor gcr en Flux notification-controller no valida la declaración de correo electrónico de los tokens OIDC de Google utilizados para la autenticación push de Pub/Sub. Esto permite que cualquier token válido emitido por Google se autentique contra el endpoint webhook del receptor, lo que desencadena reconciliaciones de Flux no autorizadas. La explotación requiere que el atacante conozca la URL del webhook del receptor. La ruta del webhook se genera como /hook/sha256sum(token+name+namespace), donde el token es una cadena aleatoria almacenada en un Secret de Kubernetes. No hay ninguna API o endpoint que enumere las URL de los webhooks. Un atacante no puede descubrir la ruta sin tener acceso al clúster y permisos para leer el .status.webhookPath del receptor en el namespace objetivo, o sin obtener la URL por otros medios (por ejemplo, secretos filtrados o acceso a la configuración de Pub/Sub). Tras una autenticación exitosa, el controlador desencadena una reconciliación para todos los recursos listados en el .spec.resources del receptor. Sin embargo, el impacto práctico es limitado: la reconciliación de Flux es idempotente, por lo que si el estado deseado en las fuentes configuradas (Git, OCI, Helm) no ha cambiado, la reconciliación resulta en una operación nula sin efecto en el estado del clúster. Además, los controladores de Flux deduplican las solicitudes de reconciliación, por lo que el envío de muchas solicitudes en un corto período resulta en que solo se procesa una única reconciliación. Esta vulnerabilidad está corregida en la versión 1.8.3. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'fluxcd', 'product': 'notification-controller', 'versions': [{'status': 'affected', 'version': '< 1.8.3'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-40109', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-04-13T20:23:57.726750Z'} -
New CVE Received by [email protected]
Apr. 09, 2026
Action Type Old Value New Value Added Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed. This vulnerability is fixed in 1.8.3. Added CVSS V3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Added CWE CWE-287 Added CWE CWE-345 Added Reference https://github.com/fluxcd/notification-controller/pull/1279 Added Reference https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3 Added Reference https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w