https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:33:37 +0000 https://cve.radiocsirt.org/vuln/bit-flux-2022-24878 <p><strong>Affected:</strong> Bitnami: flux</p> <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.</p> <p><strong>Affected:</strong> Bitnami: flux</p> <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.</p> https://cve.radiocsirt.org/vuln/bit-flux-2022-24878 https://cve.radiocsirt.org/vuln/euvd-2026-234163 EUVD-2026-234163 https://cve.radiocsirt.org/vuln/euvd-2026-234163 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24878 <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.</p> <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24878 https://cve.radiocsirt.org/vuln/ghsa-7pwf-jg34-hxwp <p><strong>Affected:</strong> Go: github.com/fluxcd/kustomize-controller, Go: github.com/fluxcd/flux2</p> <p>The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted `kustomization.yaml` to cause Denial of Service at controller level.</p> <p>In multi-tenancy deployments this can lead to multiple tenants not being able to apply their Kustomizations until the malicious `kustomization.yaml` is removed and the controller restarted.</p> <p>### Impact</p> <p>Within the affected versions, users with write access to a Flux source are able to craft a malicious `kustomization.yaml` file which causes the controller to enter an endless loop.</p> <p>### Patches</p> <p>This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce better handling of Kustomization files blocking references that could lead to endless loops.</p> <p>### Credits</p> <p>The Flux engineering team found and patched this vulnerability.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory please open an issue in the [flux2 repository](http://github.com/fluxcd/flux2).</p> <p><strong>Affected:</strong> Go: github.com/fluxcd/kustomize-controller, Go: github.com/fluxcd/flux2</p> <p>The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted `kustomization.yaml` to cause Denial of Service at controller level.</p> <p>In multi-tenancy deployments this can lead to multiple tenants not being able to apply their Kustomizations until the malicious `kustomization.yaml` is removed and the controller restarted.</p> <p>### Impact</p> <p>Within the affected versions, users with write access to a Flux source are able to craft a malicious `kustomization.yaml` file which causes the controller to enter an endless loop.</p> <p>### Patches</p> <p>This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce better handling of Kustomization files blocking references that could lead to endless loops.</p> <p>### Credits</p> <p>The Flux engineering team found and patched this vulnerability.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory please open an issue in the [flux2 repository](http://github.com/fluxcd/flux2).</p> https://cve.radiocsirt.org/vuln/ghsa-7pwf-jg34-hxwp https://cve.radiocsirt.org/vuln/gsd-2022-24878 gsd-2022-24878 https://cve.radiocsirt.org/vuln/gsd-2022-24878