Skip to content

Security: Multiple CVEs detected in flagger container image — plans for a patch release? #1956

Description

@Tomalong

Hi Flagger maintainers,

We've been scanning the ghcr.io/fluxcd/flagger container image and our tooling has flagged the following CVEs against the current release:

CVE
CVE-2026-33811
CVE-2026-33814
CVE-2026-39820
CVE-2026-39836
CVE-2026-42499

We don't yet have full details on which specific dependencies or base image layers are responsible for each CVE, but wanted to raise them here in case the maintainers have visibility or are already tracking them.

Questions:

  1. Are any of these CVEs already on your radar?
  2. Are there plans for a patch release in the near term to address them?
  3. Is there anything we can do in the meantime (e.g. a base image rebuild, specific dependency upgrade) to remediate while waiting for an upstream release?

For context, we noticed the upstream release cadence has slowed to roughly one release every 3–6 months, so we want to understand whether a fix will land soon or whether we need to consider a local patching strategy.

Thanks for maintaining Flagger — we appreciate the project!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions