The Flux Operator Web UI contains a privilege escalation flaw that lets an attacker bypass Kubernetes RBAC impersonation, caused by unvalidated empty OIDC claim values. The vulnerability manifests when the OIDC provider returns missing email or groups or when custom CEL expressions evaluate to empty strings, resulting in no impersonation headers and execution under the operator’s service account. This can lead to unauthorized API calls, data exposure, or information disclosure, as the attacker gains the full permissions of the operator’s service account.

The vulnerability affects the Flux Operator provided by controlplaneio-fluxcd. Versions starting from 0.36.0 up through the last release before 0.40.0 (i.e., 0.39.x) are vulnerable. Users running any of those versions should verify their installation and upgrade when possible.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is below 1%, suggesting a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a misconfigured OIDC provider or CEL expressions that produce empty claim values; once triggered, an attacker can run API requests with the Flux Operator’s service account privileges, bypassing all RBAC restrictions.