Go/github.com/controlplaneio-fluxcd/flux-operator CVE-2026-23990: medium 5.3, EPSS 0.35%

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

Action: Upgrade github.com/controlplaneio-fluxcd/flux-operator to 0.40.0 or later.

go get github.com/controlplaneio-fluxcd/flux-operator@v0.40.0

Affected

Fixed versions

Sources

• osv: GHSA-4xh5-jcj2-ch8q
• https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q
• https://nvd.nist.gov/vuln/detail/CVE-2026-23990
• https://github.com/controlplaneio-fluxcd/flux-operator/pull/610
• https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e
• https://github.com/controlplaneio-fluxcd/flux-operator
• https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0

CVE-2026-23990 · published 2026-01-21T22:23:33Z · modified 2026-09-10T03:49:54.329049168Z · JSON