CVE-2021-41254: Privilege Escalation in github.com/fluxcd/kustomize-controller
Summary
CVE-2021-41254: Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller. Affects github.com/fluxcd/kustomize-controller versions < 0.15.0. Fixed in 0.15.0. How to fix ↓
Also tracked for
- kustomize · Bitnami
The same CVE-2021-41254 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/fluxcd/kustomize-controller package is a Go-based controller for managing Kubernetes resources using Kustomize. It provides functionality for deploying and managing applications in multi-tenant environments. This package is vulnerable to a privilege escalation vulnerability that allows an attacker to gain cluster admin privileges in multi-tenant environments.
Vulnerability Detail
The vulnerability (CVE-2021-41254) in github.com/fluxcd/kustomize-controller enables an attacker to escalate their privileges to cluster admin in multi-tenant environments. This can have severe consequences as the attacker would gain full control over the Kubernetes cluster, potentially leading to unauthorized access, data breaches, and disruption of services. The vulnerability exists in versions prior to 0.15.0 of the package.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/fluxcd/kustomize-controller@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.15.0
This is the first release that contains the fix.
go get github.com/fluxcd/kustomize-controller@v0.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
The vulnerability (CVE-2021-41254) in github.com/fluxcd/kustomize-controller allows for privilege escalation to cluster admin in multi-tenant environments. To mitigate this vulnerability, it is crucial to update to version 0.15.0 or later of the package. Regularly updating and patching all dependencies is also important to ensure the latest security fixes are applied.
See every vulnerability recorded for github.com/fluxcd/kustomize-controller →
FAQ
The impact of this vulnerability is that an attacker can gain cluster admin privileges in multi-tenant environments, allowing them full control over the Kubernetes cluster.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to update to the fixed version to mitigate the risk.
Yes, this vulnerability can be exploited remotely if the affected package is used in a publicly accessible application or service.
Yes, a patch is available in version 0.15.0 of the github.com/fluxcd/kustomize-controller package. It is recommended to update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/kustomize-controller.
