CVE-2026-23990: Flux Operator Privilege Escalation Flaw

CVE-2026-23990 Overview

CVE-2026-23990 is a privilege escalation vulnerability in the Flux Operator Web UI authentication code that allows attackers to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution.

The vulnerability exists in versions 0.36.0 through 0.39.x and stems from insufficient validation of OIDC token claims after they are processed through CEL expressions. When an OIDC provider issues tokens lacking expected claims (such as email or groups), or when custom CEL expressions evaluate to empty values, the resulting username and groups values become empty. Without proper validation, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to execute with the flux-operator service account's elevated credentials instead of the authenticated user's limited permissions.

Critical Impact

Successful exploitation allows authenticated users to escalate privileges to the flux-operator service account level, potentially leading to unauthorized access to Kubernetes resources, data exposure, and information disclosure across the cluster.

Affected Products

• Flux Operator versions 0.36.0 to 0.39.x
• Kubernetes clusters using Flux Operator Web UI with OIDC authentication
• ControlPlane enterprise distribution deployments using vulnerable Flux Operator versions

Discovery Timeline

• 2026-01-21 - CVE CVE-2026-23990 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-23990

Vulnerability Analysis

This vulnerability represents an authorization bypass condition in the Flux Operator's authentication flow. The issue centers on the interaction between OIDC token processing, CEL (Common Expression Language) claim extraction, and the Kubernetes client-go impersonation mechanism.

When users authenticate via OIDC, their token claims are processed through configurable CEL expressions to extract username and group membership information. The extracted values are then used to construct impersonation headers for Kubernetes API requests. However, prior to version 0.40.0, no validation existed to ensure that the extracted username and groups values were non-empty after CEL processing.

This gap becomes exploitable when cluster administrators configure the Flux Operator with OIDC providers that issue tokens without the expected claims, or when custom CEL expressions inadvertently evaluate to empty strings. The Kubernetes client-go library interprets empty impersonation values as "no impersonation required," causing subsequent API requests to execute with the flux-operator service account's privileges rather than the authenticated user's constrained permissions.

Root Cause

The root cause is a missing input validation check for impersonation values after CEL expression evaluation. The code processed OIDC claims through CEL expressions but did not verify that the resulting impersonation configuration contained valid, non-empty username and groups values before passing them to the Kubernetes API client. This oversight allows a state where authenticated users inadvertently (or deliberately) gain elevated privileges.

Attack Vector

The attack requires network access to the Flux Operator Web UI and valid OIDC authentication. An attacker must have low-privilege access and identify a configuration where their OIDC token lacks expected claims or where CEL expressions produce empty values. The attack proceeds as follows:

1. Attacker authenticates to the Flux Operator Web UI using valid OIDC credentials
2. The OIDC token is processed, but claim extraction via CEL expressions yields empty values
3. Empty impersonation headers are not added to Kubernetes API requests
4. API requests execute with flux-operator service account privileges
5. Attacker gains unauthorized access to Kubernetes resources beyond their intended permissions

The following patch was applied in version 0.40.0 to address this vulnerability by adding validation:

 		imp.Groups = []string{}
 	}

+	// Sanitize and validate the extracted impersonation.
+	if err := imp.SanitizeAndValidate(); err != nil {
+		return nil, fmt.Errorf("impersonation validation failed: %w", err)
+	}
+
 	return &user.Details{
 		Profile:       profile,
 		Impersonation: imp,

Source: GitHub Commit Changes

Detection Methods for CVE-2026-23990

Indicators of Compromise

• Kubernetes audit logs showing API requests from the flux-operator service account that don't match expected automated operations
• Unexpected resource access patterns from users authenticated via OIDC without corresponding impersonation headers
• Flux Operator Web UI authentication events where username or groups fields are empty or null
• Anomalous privilege usage patterns where low-privilege users access high-privilege resources

Detection Strategies

• Enable and monitor Kubernetes audit logging for all API requests originating from the flux-operator service account
• Implement alerting for API requests lacking impersonation headers when originating from the Web UI
• Review OIDC provider token claim configurations to ensure expected claims are always present
• Audit CEL expressions in Flux Operator configuration for potential empty value scenarios

Monitoring Recommendations

• Configure SIEM rules to detect flux-operator service account activity outside normal GitOps operations
• Monitor authentication logs for OIDC tokens with missing or empty claim values
• Set up alerts for privilege escalation patterns in Kubernetes RBAC audit logs
• Implement regular configuration reviews of Flux Operator OIDC settings

How to Mitigate CVE-2026-23990

Immediate Actions Required

• Upgrade Flux Operator to version 0.40.0 or later immediately
• Audit current OIDC provider configurations to ensure tokens include all expected claims
• Review and test CEL expressions to verify they cannot evaluate to empty values
• Temporarily restrict access to the Flux Operator Web UI until patching is complete

Patch Information

Version 0.40.0 of the Flux Operator includes the security fix that adds the SanitizeAndValidate() function call to verify impersonation values are non-empty before processing API requests. The patch is available via the GitHub Release v0.40.0. Additional details can be found in the GitHub Security Advisory GHSA-4xh5-jcj2-ch8q.

Workarounds

• Configure OIDC providers to always include required claims (email, groups) in tokens
• Modify CEL expressions to include fallback values that prevent empty evaluations
• Implement network policies to restrict access to the Flux Operator Web UI to trusted networks only
• Temporarily disable OIDC authentication and use alternative authentication methods until patching is complete

# Verify Flux Operator version
kubectl get deployment flux-operator -n flux-system -o jsonpath='{.spec.template.spec.containers[0].image}'

# Upgrade Flux Operator to patched version
helm upgrade flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
  --version 0.40.0 \
  --namespace flux-system

# Verify the upgrade was successful
kubectl rollout status deployment/flux-operator -n flux-system