CVE-2026-47680: Source Controller Path Traversal Vulnerability in GitHub.com/fluxcd/source-controller
Summary
CVE-2026-47680: Source controller: Improper path handling allows traversal. Affects github.com/fluxcd/source-controller versions >= 0.0.17, < 1.8.5. Fixed in 1.8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The source-controller is a component of the Flux ecosystem, designed to manage and reconcile source code repositories and artifacts in Kubernetes environments. It facilitates the integration of GitOps principles by automating the deployment of applications based on changes in source code. However, the source-controller has been found to have a vulnerability that allows for improper path handling, potentially leading to unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from improper path handling within the source-controller, specifically in the Bucket reconciler and the GitRepository sparse-checkout feature. An attacker with the ability to influence the contents of a referenced bucket can exploit this flaw to write fetched object data to paths outside the designated working directory. Although the source-controller and downstream Flux controllers perform digest verification to prevent manipulated artifacts from reaching the cluster, the attacker can still write files to any location where the source-controller pod has write permissions. Additionally, users with permission to create or update GitRepository resources can enumerate file paths outside the cloned repository, exposing sensitive information.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/fluxcd/source-controller@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.5
This is the first release that contains the fix.
go get github.com/fluxcd/source-controller@v1.8.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a defense-in-depth measure, deploy a ValidatingAdmissionPolicy or use a third-party policy engine like Kyverno or OPA Gatekeeper to reject GitRepository resources that contain '..' or absolute path segments in their .spec.sparseCheckout entries. This can be configured with the following example policy:
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: reject-invalid-sparse-checkout
spec:
matchPolicy: Equivalent
rules:
- operations: ["CREATE", "UPDATE"]
apiGroups: ["source.toolkit.fluxcd.io"]
resources: ["gitrepositories"]
scope: "Namespaced"
validation:
message: "Invalid sparseCheckout entry."
pattern:
spec:
sparseCheckout:
- not: ["..", "/"]
Conclusion
The source-controller vulnerability CVE-2026-47680 poses a moderate risk due to improper path handling, allowing potential path traversal attacks. Users are strongly advised to upgrade to version 1.8.5 or later to mitigate this risk and implement the recommended workarounds for additional security.
See every vulnerability recorded for github.com/fluxcd/source-controller →
FAQ
CVE-2026-47680 is a vulnerability in the source-controller that allows for improper path handling, leading to potential path traversal attacks.
If exploited, this vulnerability can allow an attacker to write files to unauthorized locations within the source-controller pod, potentially leading to data corruption or unauthorized access.
The vulnerability affects source-controller versions up to and including 1.8.4. Version 1.8.5 and later contain the necessary patches.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If an immediate upgrade is not possible, implement the suggested workaround by deploying a ValidatingAdmissionPolicy to restrict invalid sparse-checkout entries.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/source-controller.
