—

GO-2026-5419

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Quick fix

GO-2026-5419 — github.com/fluxcd/notification-controller: upgrade to the fixed version with the command below.

go get github.com/fluxcd/notification-controller@v1.8.3

Details

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/fluxcd/notification-controller

Introduced in: 0Fixed in: 1.8.3

Fixgo get github.com/fluxcd/notification-controller@v1.8.3

References

https://github.com/fluxcd/notification-controller/security/advisories/GHSA-h9cx-xjg6-5v2w[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-40109[ADVISORY]
https://github.com/fluxcd/notification-controller/pull/1279[FIX]
https://github.com/fluxcd/notification-controller/releases/tag/v1.8.3[WEB]