https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:10:41 +0000 https://cve.radiocsirt.org/vuln/bit-flux-2022-24877 <p><strong>Affected:</strong> Bitnami: flux</p> <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.</p> <p><strong>Affected:</strong> Bitnami: flux</p> <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.</p> https://cve.radiocsirt.org/vuln/bit-flux-2022-24877 https://cve.radiocsirt.org/vuln/euvd-2026-234165 EUVD-2026-234165 https://cve.radiocsirt.org/vuln/euvd-2026-234165 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24877 <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.</p> <p>Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user&#39;s CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24877 https://cve.radiocsirt.org/vuln/ghsa-j77r-2fxf-5jrw <p><strong>Affected:</strong> Go: github.com/fluxcd/kustomize-controller, Go: github.com/fluxcd/flux2</p> <p>The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted `kustomization.yaml` to expose sensitive data from the controller’s pod filesystem. In multi-tenancy deployments this can lead to privilege escalation if the controller&#39;s service account has elevated permissions.</p> <p>Within the affected versions, users with write access to a Flux source are able to use built-in features to expose sensitive data from the controller’s pod filesystem using a malicious `kustomization.yaml` file.</p> <p>This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce a new Kustomize file system implementation which ensures that all files being handled are contained within the Kustomization working directory, blocking references to any files that do not meet that requirement.</p> <p>Automated tooling (e.g. conftest) could be employed as a workaround, as part of a user&#39;s CI/CD pipeline to ensure that their `kustomization.yaml` files conform with specific policies, blocking access to sensitive path locations.</p> <p><strong>Affected:</strong> Go: github.com/fluxcd/kustomize-controller, Go: github.com/fluxcd/flux2</p> <p>The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted `kustomization.yaml` to expose sensitive data from the controller’s pod filesystem. In multi-tenancy deployments this can lead to privilege escalation if the controller&#39;s service account has elevated permissions.</p> <p>Within the affected versions, users with write access to a Flux source are able to use built-in features to expose sensitive data from the controller’s pod filesystem using a malicious `kustomization.yaml` file.</p> <p>This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce a new Kustomize file system implementation which ensures that all files being handled are contained within the Kustomization working directory, blocking references to any files that do not meet that requirement.</p> <p>Automated tooling (e.g. conftest) could be employed as a workaround, as part of a user&#39;s CI/CD pipeline to ensure that their `kustomization.yaml` files conform with specific policies, blocking access to sensitive path locations.</p> https://cve.radiocsirt.org/vuln/ghsa-j77r-2fxf-5jrw https://cve.radiocsirt.org/vuln/gsd-2022-24877 gsd-2022-24877 https://cve.radiocsirt.org/vuln/gsd-2022-24877