Flux source-controller (Bucket artifact write path, GitRepository sparse-checkout): An actor who can influence the

Impact

An actor who can influence the contents of a bucket referenced by a Bucket resource can make source-controller write fetched object data to paths outside its per-reconciliation working directory - anywhere the controller pod has write permission. Digest verification in source-controller and in the downstream kustomize-controller and helm-controller keeps a manipulated artifact from reaching the cluster, so this is corruption of the controller pod rather than a path to arbitrary cluster state. A second, smaller surface exists on v1.6.0 and later: a user who can create or update GitRepository resources can use sparse-checkout paths to test for files outside the clone and read the result back from the resource status, enumerating paths on the controller pod. In a GitOps-managed GPU cluster the source-controller is the component every workload definition passes through, so degrading it stalls reconciliation fleet-wide.

Who can reach it

For the write primitive, anyone who can put objects into an S3-compatible bucket that a Bucket resource references - including a tenant or CI job with write access to that bucket. For the path enumeration, an authenticated user with RBAC to create or update GitRepository resources.

What to do

Upgrade source-controller to v1.8.5; there is no in-product workaround. This is a rolling restart of the source-controller deployment in flux-system, not a node operation. As defense in depth for the sparse-checkout surface, add a ValidatingAdmissionPolicy (or Kyverno/OPA Gatekeeper rule) rejecting GitRepository resources whose .spec.sparseCheckout entries contain '..' or absolute path segments.

References

Related entries

• Podman: Malicious image WORKDIR symlink creates directories or changes ownership on the host filesystemCVE-2026-55686 · PodmanMedium
• BuildKit: invalid SecurityMode disables Seccomp and AppArmor without the insecure entitlementCVE-2026-61711 · BuildKit executor/oci/spec_linux.go (SecurityMode validation)Medium
• JFrog Artifactory: authenticated write outside the Docker repository cache pathCVE-2026-66384 · JFrog Artifactory (Docker remote repository cache path)Medium
• Rancher Fleet: Helm template preprocessing reaches the network, leaking cluster metadata via DNSCVE-2026-75036 · Rancher Fleet controller (Helm template preprocessing / GitRepo bundle content)Medium
• containerd: containerd-shim abstract-socket API exposed to host-network containersCVE-2020-15257 · containerdMedium
• Kubernetes (kube-apiserver): Aggregated API server can redirect apiserver clientsCVE-2022-3172 · Kubernetes (kube-apiserver)Medium