CVE-2026-23990: 
Wolfi vulnerability analysis and mitigation

CVE-2026-23990 is a privilege escalation vulnerability titled "Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims" affecting the Flux Operator Kubernetes CRD controller. It impacts versions 0.36.0 through 0.39.x of github.com/controlplaneio-fluxcd/flux-operator (Go module) and was discovered by the Flux Operator maintainers during a debugging session with end-users. The advisory was published on January 21, 2026, with the patch released the same day in version 0.40.0. It carries a CVSS v3.1 base score of 5.3 (Moderate) (GitHub Advisory, Security Advisory).

The root cause is classified as CWE-269 (Improper Privilege Management) and CWE-862 (Missing Authorization). After OIDC token claims are processed through CEL (Common Expression Language) expressions to extract username and groups, there is no validation that the resulting values are non-empty. The default CEL expressions — has(claims.email) ? claims.email : '' for username and has(claims.groups) ? claims.groups : [] for groups — evaluate to empty values when the OIDC provider does not include email or groups claims in its tokens. When both values are empty, the Kubernetes client-go library omits impersonation headers from API requests, causing all subsequent requests to execute under the flux-operator service account's credentials rather than the authenticated user's restricted permissions. Exploitation requires the cluster to be configured with an OIDC provider that omits expected claims, or custom CEL expressions that can evaluate to empty values (GitHub Advisory, Security Advisory).

Successful exploitation allows any authenticated user to escalate to operator-level permissions, bypassing their assigned Kubernetes RBAC restrictions. The attacker gains unauthorized read access to Flux resources across all namespaces, can perform suspend/resume/reconcile actions, and can view sensitive GitOps pipeline configurations, source repository URLs, and deployment status across the entire cluster. The primary impact is high confidentiality loss (unauthorized data exposure and information disclosure), with no direct integrity or availability impact per the CVSS scoring (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.035% (0.000350), indicating a low near-term exploitation probability. Exploitation requires low privileges (a valid OIDC token) and high attack complexity, as the vulnerable configuration — an OIDC provider omitting email/groups claims — must be present (GitHub Advisory).

1. Identify a vulnerable deployment: Locate a Flux Operator Web UI instance running versions 0.36.0–0.39.x that is configured with OIDC authentication where the identity provider does not issue email or groups claims in its tokens, or uses custom CEL expressions that can evaluate to empty strings.
2. Obtain a valid OIDC token: Authenticate against the configured OIDC provider using any valid low-privileged account. The token signature will be valid even though it lacks the expected claims.
3. Authenticate to the Flux Operator Web UI: Present the valid OIDC token to the Web UI. The CEL expressions evaluate to empty values (username = "", groups = []), but authentication succeeds because the token signature is valid.
4. Trigger impersonation bypass: The userClient is created with an empty impersonation configuration. Because both username and groups are empty, the Kubernetes client-go library does not add Impersonate-User or Impersonate-Group headers to outgoing API requests.
5. Execute privileged API requests: All API requests are now executed as the flux-operator service account, granting operator-level read access across all namespaces — including the ability to view Flux resources, GitOps pipeline configurations, source URLs, and deployment status, and to perform suspend/resume/reconcile actions (GitHub Advisory, Security Advisory).

• Logs: Kubernetes API server audit logs showing API requests attributed to the flux-operator service account originating from Web UI sessions where the user identity is absent or anonymous; absence of Impersonate-User or Impersonate-Group headers in requests that should carry them.
• Logs: Flux Operator Web UI access logs showing authenticated OIDC sessions followed by API calls executed without impersonation context (no user/group identity recorded in request metadata).
• Network: Unusual volume of read requests to Flux CRD resources (e.g., kustomizations, helmreleases, gitrepositories) across multiple namespaces from a single Web UI session, inconsistent with the user's expected RBAC scope.
• Behavioral: Low-privileged users accessing Flux resources in namespaces they should not have permission to view, or performing reconcile/suspend/resume actions beyond their assigned roles (GitHub Advisory).

Upgrade Flux Operator to version 0.40.0 or later, which adds a SanitizeAndValidate() check that rejects authentication when both username and groups evaluate to empty values after CEL processing (v0.40.0 Release). As a workaround for organizations unable to patch immediately, configure the OIDC impersonation section to require email and groups claims explicitly (e.g., set impersonation.username: claims.email and impersonation.groups: claims.groups) so that missing claims cause authentication to fail rather than silently bypass impersonation. Additionally, restrict network access to the Flux Operator Web UI using network policies or firewall rules to limit exposure to trusted sources only (GitHub Advisory, Security Advisory).

The vulnerability was discovered internally by the Flux Operator maintainers (Stefan Prodan and Matheus Pimenta) during a debugging session with end-users, and was responsibly disclosed alongside the patch release on January 21, 2026 (Security Advisory). The fix (PR #610) received positive reactions from community members including stealthybox and sublimino. No significant broader media coverage or external researcher commentary has been identified beyond standard vulnerability database aggregation.