CVE-2026-23990
2 advisories.
Go/github.com/controlplaneio-fluxcd/flux-operator CVE-2026-23990: medium 5.3
Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims
Action: Upgrade github.com/controlplaneio-fluxcd/flux-operator to 0.40.0 or later.
go get github.com/controlplaneio-fluxcd/flux-operator@v0.40.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.36.0 | 0.40.0 | - |
Fixed versions
| 0.40.0 |
Sources
- osv: GHSA-4xh5-jcj2-ch8q
- https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q
- https://nvd.nist.gov/vuln/detail/CVE-2026-23990
- https://github.com/controlplaneio-fluxcd/flux-operator/pull/610
- https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e
- https://github.com/controlplaneio-fluxcd/flux-operator
- https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0
CVE-2026-23990 · published · modified · JSON
Go/github.com/controlplaneio-fluxcd/flux-operator CVE-2026-23990: unknown
Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator
Action: Upgrade github.com/controlplaneio-fluxcd/flux-operator to 0.40.0 or later.
go get github.com/controlplaneio-fluxcd/flux-operator@v0.40.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.36.0 | 0.40.0 | - |
Fixed versions
| 0.40.0 |
Sources
- osv: GO-2026-4351
- https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q
- https://nvd.nist.gov/vuln/detail/CVE-2026-23990
- https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e
- https://github.com/controlplaneio-fluxcd/flux-operator/pull/610
- https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0
CVE-2026-23990 · published · modified · JSON