Go/github.com/fluxcd/flux2 CVE-2022-24817: critical 9.9, EPSS 1.12%

Improper kubeconfig validation allows arbitrary code execution

Action: Upgrade github.com/fluxcd/flux2 to 0.29.0 or later.

go get github.com/fluxcd/flux2@v0.29.0

Affected

Fixed versions

Sources

• osv: GHSA-vvmq-fwmg-2gjc
• https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc
• https://nvd.nist.gov/vuln/detail/CVE-2022-24817
• https://github.com/fluxcd/flux2

CVE-2022-24817 · published 2022-05-16T18:13:51Z · modified 2025-12-02T18:27:40.180830Z · JSON