FluxCD: SSRF via notification-controller Provider.spec.address #1301

Activity

1. llooFlashooll

   changed the title [-]FluxCD: SSRF via notification-controller `Provider.spec.address` (POST + Header Injection)[/-] [+]FluxCD: SSRF via notification-controller `Provider.spec.address`[/+] on Apr 28, 2026
2. llooFlashooll

   closed this as completedon Apr 28, 2026
3. matheuscscp commented on Apr 28, 2026

   

   matheuscscp

   on Apr 28, 2026

   Member

   More actions

   @llooFlashooll Next time you try to disclose a CVE not following the secret disclosure process you're going to be banned from the fluxcd org
4. llooFlashooll commented on Apr 29, 2026

   

   llooFlashooll

   on Apr 29, 2026

   Author

   More actions

   No problem sir! @matheuscscp Actually I have privately disclosed through emails, but no one replied me for more than a week. 😢
5. matheuscscp commented on Apr 29, 2026

   

   matheuscscp

   on Apr 29, 2026

   Last edited by matheuscscp

   Member

   More actions

   @llooFlashooll That's because we receive tons of false-positive SSRF reports for .spec.{address|url} that we need to go over, plus a bunch of AI slop. Your report not getting a reply there does not warrant you coming here and doing what you did, especially in the age of scoring things easily with AI.
6. fluxcd

   locked as spam and limited conversation to collaborators on Apr 29, 2026
7. matheuscscp

   reopened this on May 1, 2026
8. matheuscscp commented on May 1, 2026

   

   matheuscscp

   on May 1, 2026

   Member

   More actions

   Reopened the issue, we will close it with a section here: https://fluxcd.io/flux/security/best-practices/

   This is not a problem that should be solved in Flux. Instead, users should use ValidatingAdmissionPolicy to enforce trusted addresses. I will open a PR in the website to add this section and close this issue.