Is CVE-2026-40109 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40109 being exploited in the wild.

How severe is CVE-2026-40109?

Low severity, with a CVSS score of 3.1, published 9 April 2026.

Which products and versions are affected?

FluxCD Notification-Controller < 1.8.3; github.com/fluxcd/notification-controller (Go) < 1.8.3, SEMVER:introduced=0,fixed=1.8.3.

Is there a fix for CVE-2026-40109?

Yes. github.com/fluxcd/notification-controller (Go): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40109 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40109?

Check whether you run FluxCD Notification-Controller or github.com/fluxcd/notification-controller (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40109: Flux notification-controller improper authentication in GCR Receiver

Q: Is there a fix for CVE-2026-40109?

Yes. github.com/fluxcd/notification-controller (Go): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40109 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-40109?

Check whether you run FluxCD Notification-Controller or github.com/fluxcd/notification-controller (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40109 · Severity: low · CVSS 3.1 · Published 2026-04-09

Flux is a tool used to automate the deployment of applications to Kubernetes clusters. A vulnerability in its notification component allows an attacker with a valid Google account to trigger a synchronization process between the cluster and its source code repositories. While this could lead to unauthorized system activity, the practical impact is low because the process only synchronizes to the state already defined in your secure code repositories.

Vendors: Go.

Quick answers

Is CVE-2026-40109 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40109 being exploited in the wild.
How severe is CVE-2026-40109?: Low severity, with a CVSS score of 3.1, published 9 April 2026.
Which products and versions are affected?: FluxCD Notification-Controller < 1.8.3; github.com/fluxcd/notification-controller (Go) < 1.8.3, SEMVER:introduced=0,fixed=1.8.3.
Is there a fix for CVE-2026-40109?: Yes. github.com/fluxcd/notification-controller (Go): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40109 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40109?: Check whether you run FluxCD Notification-Controller or github.com/fluxcd/notification-controller (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/fluxcd/notification-controller (Go): upgrade to 1.8.3 or later
```
go get github.com/fluxcd/notification-controller@v1.8.3
```

Technical details

The 'gcr' Receiver type in Flux notification-controller does not validate the 'email' claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued JWT to authenticate against the Receiver webhook endpoint. An attacker who discovers the webhook URL (which is a SHA256 hash of the token, name, and namespace) can trigger unauthorized Flux reconciliations for resources listed in the Receiver's specification. The impact is mitigated by the idempotent nature of Flux reconciliations and request deduplication. The issue is fixed in version 1.8.3 by allowing optional validation of 'email' and 'audience' claims.

Affected products

FluxCD notification-controller < 1.8.3

Identifiers

CVE-2026-40109
GHSA-h9cx-xjg6-5v2w
GO-2026-5419

Timeline

2026-04-09: patched: Version 1.8.3 released
2026-04-10: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.