{"action":"Upgrade github.com/controlplaneio-fluxcd/flux-operator to 0.40.0 or later.","affected":[{"fixed":"0.40.0","introduced":"0.36.0"}],"component":"github.com/controlplaneio-fluxcd/flux-operator","cve_ids":["CVE-2026-23990"],"ecosystem":"Go","epss":0.00348,"exploited":false,"fixed_versions":["0.40.0"],"ghsa_id":"GHSA-4xh5-jcj2-ch8q","id":"tcs_01M5KGD9FGQ3VY7XN1PH5NTZF7","modified_at":"2026-02-04T22:28:47.867497Z","published_at":"2026-02-02T21:05:55Z","references":["https://osv.dev/vulnerability/GO-2026-4351","https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q","https://nvd.nist.gov/vuln/detail/CVE-2026-23990","https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e","https://github.com/controlplaneio-fluxcd/flux-operator/pull/610","https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GO-2026-4351","url":"https://osv.dev/vulnerability/GO-2026-4351"},{"source":"nvd","source_id":"CVE-2026-23990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23990"}],"summary":"Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator"}