5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23990

CVE-2026-23990: Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. In order to be vulnerable, cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., email, groups), or configure custom CEL expressions that can evaluate to empty values. After OIDC token claims are processed through CEL expressions, there is no validation that the resulting username and groups values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account's credentials instead of the authenticated user's limited permissions. This can result in privilege escalation, data exposure, and/or information disclosure. Version 0.40.0 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23990

CVE-2026-23990:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/controlplaneio-fluxcd/flux-operator	go	>= 0.36.0, < 0.40.0	0.40.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation in the Flux Operator Web UI, identified as GHSA-4xh5-jcj2-ch8q. The root cause is the lack of validation of user impersonation details derived from OIDC token claims. Specifically, the newClaimsProcessor function in internal/web/auth/claims.go would process OIDC claims but failed to ensure that the resulting username and groups for impersonation were not empty.

According to the Kubernetes client-go library's behavior, if both impersonation username and groups are empty, no impersonation headers are added to API requests. This caused the requests to be executed with the permissions of the Flux Operator's own service account, leading to a privilege escalation. An authenticated user could exploit this by using an OIDC token that, when processed by the configured CEL expressions, yielded empty values for both username and groups.

The patch introduces a new function, SanitizeAndValidate, on the Impersonation struct, which ensures that at least a username or one group is present and that they are not empty or just whitespace. This validation is now called from newClaimsProcessor after claims are processed, effectively closing the vulnerability. A similar hardening was applied to the AnonymousAuthenticationSpec.Validate method to ensure consistent security validation for all authentication methods.

Vulnerable functions

newClaimsProcessor

internal/web/auth/claims.go

This function is responsible for processing OIDC claims to extract user impersonation details (username and groups). Before the patch, it did not validate whether the extracted username and groups were empty. If an OIDC provider was configured to issue tokens that resulted in empty values for these fields, the Kubernetes client would not apply any impersonation, causing API requests to be executed with the high-privilege flux-operator service account instead of the user's intended restricted permissions.

AnonymousAuthenticationSpec.Validate

internal/web/config/authentication_types.go

This method validates the configuration for anonymous authentication. The original implementation had a basic check for an empty username and groups. This was replaced by a more robust validation function (`SanitizeAndValidate`) to prevent similar impersonation bypass vulnerabilities that could arise from misconfiguration (e.g., using whitespace-only values) in the anonymous authentication settings.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.