# CVE-2026-40109: Flux notification-controller improper authentication in GCR Receiver

Source: https://junglewise.ai/threats/cve-2026-40109-flux-notification-controller-improper-authentication-in-gcr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40109 · Severity: low · CVSS 3.1 · Published 2026-04-09

Flux is a tool used to automate the deployment of applications to Kubernetes clusters. A vulnerability in its notification component allows an attacker with a valid Google account to trigger a synchronization process between the cluster and its source code repositories. While this could lead to unauthorized system activity, the practical impact is low because the process only synchronizes to the state already defined in your secure code repositories.

Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40109 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40109 being exploited in the wild.

**How severe is CVE-2026-40109?** Low severity, with a CVSS score of 3.1, published 9 April 2026.

**Which products and versions are affected?** FluxCD Notification-Controller < 1.8.3; github.com/fluxcd/notification-controller (Go) < 1.8.3, SEMVER:introduced=0,fixed=1.8.3.

**Is there a fix for CVE-2026-40109?** Yes. github.com/fluxcd/notification-controller (Go): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40109 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40109?** Check whether you run FluxCD Notification-Controller or github.com/fluxcd/notification-controller (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/fluxcd/notification-controller (Go): upgrade to 1.8.3 or later

  ```sh
  go get github.com/fluxcd/notification-controller@v1.8.3
  ```


## Technical details

The 'gcr' Receiver type in Flux notification-controller does not validate the 'email' claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued JWT to authenticate against the Receiver webhook endpoint. An attacker who discovers the webhook URL (which is a SHA256 hash of the token, name, and namespace) can trigger unauthorized Flux reconciliations for resources listed in the Receiver's specification. The impact is mitigated by the idempotent nature of Flux reconciliations and request deduplication. The issue is fixed in version 1.8.3 by allowing optional validation of 'email' and 'audience' claims.

## Affected products

- FluxCD notification-controller < 1.8.3

## Identifiers

- CVE-2026-40109
- GHSA-h9cx-xjg6-5v2w
- GO-2026-5419

## Timeline

- 2026-04-09: patched: Version 1.8.3 released
- 2026-04-10: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/saroj345](https://api.github.com/users/saroj345)
- [https://github.com/saroj345](https://github.com/saroj345)
- [https://api.github.com/users/saroj345/gists%7B/gist_id%7D](https://api.github.com/users/saroj345/gists%7B/gist_id%7D)
- [https://api.github.com/users/saroj345/repos](https://api.github.com/users/saroj345/repos)
- [https://avatars.githubusercontent.com/u/59013591?v=4](https://avatars.githubusercontent.com/u/59013591?v=4)
- [https://api.github.com/users/saroj345/events%7B/privacy%7D](https://api.github.com/users/saroj345/events%7B/privacy%7D)

## Related threats

- [GO-2022-1071 - Denial of service in flux controllers in github.com/fluxcd modules](https://junglewise.ai/threats/cve-2022-39272-improper-use-of-metav1-duration-allows-for-denial-of-service)