Flux source-controller (Bucket artifact write path, GitRepository sparse-checkout): An actor who can influence the

Impact

An actor who can influence the contents of a bucket referenced by a Bucket resource can make source-controller write fetched object data to paths outside its per-reconciliation working directory - anywhere the controller pod has write permission. Digest verification in source-controller and in the downstream kustomize-controller and helm-controller keeps a manipulated artifact from reaching the cluster, so this is corruption of the controller pod rather than a path to arbitrary cluster state. A second, smaller surface exists on v1.6.0 and later: a user who can create or update GitRepository resources can use sparse-checkout paths to test for files outside the clone and read the result back from the resource status, enumerating paths on the controller pod. In a GitOps-managed GPU cluster the source-controller is the component every workload definition passes through, so degrading it stalls reconciliation fleet-wide.

Who can reach it

For the write primitive, anyone who can put objects into an S3-compatible bucket that a Bucket resource references - including a tenant or CI job with write access to that bucket. For the path enumeration, an authenticated user with RBAC to create or update GitRepository resources.

What to do

Upgrade source-controller to v1.8.5; there is no in-product workaround. This is a rolling restart of the source-controller deployment in flux-system, not a node operation. As defense in depth for the sparse-checkout surface, add a ValidatingAdmissionPolicy (or Kyverno/OPA Gatekeeper rule) rejecting GitRepository resources whose .spec.sparseCheckout entries contain '..' or absolute path segments.

References

Related entries

• Envoy Gateway: unsynchronized Wasm cache map read/write crashes the controller processCVE-2026-53715 · Envoy Gateway controller (internal/wasm HTTP server, port 18002)Medium
• Podman: Malicious image WORKDIR symlink creates directories or changes ownership on the host filesystemCVE-2026-55686 · PodmanMedium
• BuildKit: invalid SecurityMode disables Seccomp and AppArmor without the insecure entitlementCVE-2026-61711 · BuildKit executor/oci/spec_linux.go (SecurityMode validation)Medium
• Helm: index-out-of-range panic rendering charts that contain empty filesCVE-2026-63308 · Helm (Files.Lines template helper, pkg/engine/files.go)Medium
• Traefik Gateway API provider: extensionRef resolved in the wrong namespace, letting a route bind an ungranted MiddlewareCVE-2026-65601 · Traefik Kubernetes Gateway API provider (HTTPRoute extensionRef namespace resolution)Medium
• Traefik: IngressRouteTCP ignores crossProviderNamespaces, letting any namespace borrow file-provider mTLS identityCVE-2026-65602 · Traefik (IngressRouteTCP serversTransport cross-provider allowlist)Medium