{"action":"Upgrade github.com/controlplaneio-fluxcd/flux-operator to 0.40.0 or later.","affected":[{"fixed":"0.40.0","introduced":"0.36.0"}],"component":"github.com/controlplaneio-fluxcd/flux-operator","cve_ids":["CVE-2026-23990"],"ecosystem":"Go","epss":0.00348,"exploited":false,"fixed_versions":["0.40.0"],"ghsa_id":"GHSA-4xh5-jcj2-ch8q","id":"tcs_01M5KEXDY30JM8C68HPB96VHJM","modified_at":"2026-09-10T03:49:54.329049168Z","published_at":"2026-01-21T22:23:33Z","references":["https://osv.dev/vulnerability/GHSA-4xh5-jcj2-ch8q","https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q","https://nvd.nist.gov/vuln/detail/CVE-2026-23990","https://github.com/controlplaneio-fluxcd/flux-operator/pull/610","https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e","https://github.com/controlplaneio-fluxcd/flux-operator","https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-4xh5-jcj2-ch8q","url":"https://osv.dev/vulnerability/GHSA-4xh5-jcj2-ch8q"}],"summary":"Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims"}