Unauthenticated Reconciliation Trigger in Flux Notification-Controller by Weakened OIDC Token Validation

CVE-2026-40109

What is CVE-2026-40109?

The Flux notification-controller, responsible for event forwarding and notification dispatching in GitOps workflows, has a vulnerability due to inadequate validation of email claims in Google OIDC tokens. Prior to version 1.8.3, this weakness allows attackers to potentially authenticate against the Receiver webhook endpoint using any valid Google-issued token. The implications of this vulnerability include triggering unauthorized reconciliations of resources as specified by the Receiver. The risks are somewhat mitigated since Flux's reconciliation process is idempotent, meaning that unless the desired state of resources configured in the source has changed, there is no effect on the actual cluster state. The specific webhook URLs remain obscured unless the attacker has access to the Kubernetes cluster to read sensitive configurations. This security issue was addressed in version 1.8.3.

References