https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:36:55 +0000 https://cve.radiocsirt.org/vuln/bit-flux-2022-24817 <p><strong>Affected:</strong> Bitnami: flux</p> <p>Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller&#39;s service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0</p> <p><strong>Affected:</strong> Bitnami: flux</p> <p>Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller&#39;s service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0</p> https://cve.radiocsirt.org/vuln/bit-flux-2022-24817 https://cve.radiocsirt.org/vuln/euvd-2026-234166 EUVD-2026-234166 https://cve.radiocsirt.org/vuln/euvd-2026-234166 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24817 <p>Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller&#39;s service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0</p> <p>Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller&#39;s service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24817 https://cve.radiocsirt.org/vuln/ghsa-vvmq-fwmg-2gjc <p><strong>Affected:</strong> Go: github.com/fluxcd/flux2, Go: github.com/fluxcd/kustomize-controller, Go: github.com/fluxcd/helm-controller</p> <p>Flux2 can reconcile the state of a remote cluster when provided with a [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#file-references) with the correct access rights. `Kubeconfig` files can define [commands](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target cluster, could craft a `kubeconfig` to execute arbitrary code inside the controller’s container.</p> <p>In multi-tenancy deployments this can also lead to privilege escalation if the controller&#39;s service account has elevated permissions.</p> <p>### Impact</p> <p>Within the affected versions range, one of the permissions set below would be required for the vulnerability to be exploited: - Direct access to the cluster to create Flux `Kustomization` or `HelmRelease` objects and Kubernetes Secrets. - Direct access to the cluster to modify existing Kubernetes secrets being used as `kubeconfig` in existing Flux `Kustomization` or `HelmRelease` objects. - Direct access to the cluster to modify existing Flux `Kustomization` or `HelmRelease` objects and access to create or modify existing Kubernetes secrets. - Access rights to make changes to a configured Flux Source (i.e. Git repository).</p> <p>### Patches</p> <p>This vulnerability was fixed in kustomize-controller [v0.23.0](https://github.com/fluxcd/kustomize-contr…</p> <p><strong>Affected:</strong> Go: github.com/fluxcd/flux2, Go: github.com/fluxcd/kustomize-controller, Go: github.com/fluxcd/helm-controller</p> <p>Flux2 can reconcile the state of a remote cluster when provided with a [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#file-references) with the correct access rights. `Kubeconfig` files can define [commands](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target cluster, could craft a `kubeconfig` to execute arbitrary code inside the controller’s container.</p> <p>In multi-tenancy deployments this can also lead to privilege escalation if the controller&#39;s service account has elevated permissions.</p> <p>### Impact</p> <p>Within the affected versions range, one of the permissions set below would be required for the vulnerability to be exploited: - Direct access to the cluster to create Flux `Kustomization` or `HelmRelease` objects and Kubernetes Secrets. - Direct access to the cluster to modify existing Kubernetes secrets being used as `kubeconfig` in existing Flux `Kustomization` or `HelmRelease` objects. - Direct access to the cluster to modify existing Flux `Kustomization` or `HelmRelease` objects and access to create or modify existing Kubernetes secrets. - Access rights to make changes to a configured Flux Source (i.e. Git repository).</p> <p>### Patches</p> <p>This vulnerability was fixed in kustomize-controller [v0.23.0](https://github.com/fluxcd/kustomize-contr…</p> https://cve.radiocsirt.org/vuln/ghsa-vvmq-fwmg-2gjc https://cve.radiocsirt.org/vuln/gsd-2022-24817 gsd-2022-24817 https://cve.radiocsirt.org/vuln/gsd-2022-24817