The vulnerability resides in the GCR Receiver of Flux notification-controller, which fails to validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. Any valid Google‑issued token can authenticate against the Receiver webhook endpoint and cause the controller to initiate a reconciliation of all resources specified in the Receiver’s configuration. In practice, because Flux reconciliation is idempotent and requests are deduplicated, the immediate effect is often a no‑op unless the source desired state has changed. Nonetheless, the ability to trigger reconciliations without authorization represents an unauthorized control surface and potential avenue for indirect impact if upstream sources are manipulated.

Flux CD notification-controller prior to release version 1.8.3 is affected. All deployments of the Flux notification-controller before that version are susceptible, regardless of the specific cluster configuration.

The CVSS v3.1 score for this issue is 3.1, indicating low severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, implying it is not widely exploited. Attackers must know the Receiver’s webhook URL—derived from a random token, secret name, and namespace—and cannot enumerate it through an API. Therefore, exploitation requires either cluster access to read the Receiver status or otherwise obtain the leaked secret or Pub/Sub configuration. Given these constraints, the practical risk is low, but the issue still creates an unauthorized trigger that could be abused in conjunction with other changes to source repositories.