HIGH8.8Go
GHSA-35rf-v2jv-gfg7· BIT-kustomize-2021-41254, CVE-2021-41254Privilege escalation to cluster admin on multi-tenant environments
Modified: 9/10/2026
package
Go/github.com/fluxcd/kustomize-controller
pkg:go/github.com/fluxcd/kustomize-controller
HIGH7.7Go
GHSA-7pwf-jg34-hxwp· BIT-flux-2022-24878, BIT-kustomize-2022-24878Improper path handling in Kustomization files allows for denial of service
Modified: 12/2/2025
MEDIUM5.0Go
GHSA-f4p5-x4vc-mh4v· BIT-flux-2022-39272, BIT-kustomize-2022-39272Improper use of metav1.Duration allows for Denial of Service
Modified: 9/10/2026
CRITICAL9.9Go
GHSA-j77r-2fxf-5jrw· BIT-flux-2022-24877, BIT-kustomize-2022-24877Improper path handling in kustomization files allows path traversal
Modified: 9/10/2026
CRITICAL9.9Go
GHSA-vvmq-fwmg-2gjc· BIT-flux-2022-24817, BIT-kustomize-2022-24817Improper kubeconfig validation allows arbitrary code execution
Modified: 12/2/2025
—Go
GO-2022-0260· BIT-kustomize-2021-41254, CVE-2021-41254Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
Modified: 2/4/2026
—Go
GO-2022-0447· BIT-flux-2022-24877, BIT-kustomize-2022-24877Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2
Modified: 2/4/2026
—Go
GO-2022-0448· BIT-flux-2022-24878, BIT-kustomize-2022-24878Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2
Modified: 3/3/2026