Open Source Vulnerability in source-controller
Summary
CVE-2024-31216: source-controller leaks Azure Storage SAS token into logs. Affects github.com/fluxcd/source-controller versions < 1.2.5. Fixed in 1.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
source-controller is a component of Flux, a tool for managing the lifecycle of Kubernetes resources. It is written in Go and is responsible for syncing source code repositories with Kubernetes clusters. The source-controller connects to Azure Blob Storage to retrieve source code, and it supports authentication using Azure SAS tokens. However, a vulnerability in source-controller leaks the Azure SAS token into logs when encountering a connection error. This token can be exploited by an attacker with access to the logs to gain unauthorized access to Azure Blob Storage until the token expires.
Vulnerability Detail
The vulnerability in source-controller occurs when it logs the Azure SAS token along with the Azure URL in case of a connection error. This exposes the token to potential attackers who can then use it to gain unauthorized access to Azure Blob Storage. The impact of this vulnerability is considered moderate, with a CVSS score of 5.1. The vulnerability was reported and fixed by Jagpreet Singh Tamber from the Azure Arc team. The fix is available in source-controller version 1.2.5.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/fluxcd/source-controller@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.5
This is the first release that contains the fix.
go get github.com/fluxcd/source-controller@v1.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, as an alternative to using Azure SAS tokens, users can consider using Azure Workload Identity as an authentication mechanism for source-controller when connecting to Azure Blob Storage. Azure Workload Identity provides a more secure way of authenticating with Azure services.
Conclusion
The vulnerability in source-controller that leaks Azure Storage SAS tokens into logs can potentially allow unauthorized access to Azure Blob Storage. It is important to update source-controller to version 1.2.5 or later to mitigate this vulnerability. Alternatively, consider using Azure Workload Identity as an authentication mechanism. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fluxcd/source-controller →
FAQ
source-controller is a component of Flux, a tool for managing the lifecycle of Kubernetes resources. It is responsible for syncing source code repositories with Kubernetes clusters.
The vulnerability occurs when source-controller logs the Azure SAS token along with the Azure URL in case of a connection error, exposing the token to potential attackers.
The impact of this vulnerability is considered moderate, with a CVSS score of 5.1. It allows attackers with access to the source-controller logs to gain unauthorized access to Azure Blob Storage until the token expires.
This vulnerability was reported and fixed by Jagpreet Singh Tamber from the Azure Arc team.
To fix this vulnerability, it is recommended to update source-controller to version 1.2.5 or later, which includes the necessary patches to prevent the leakage of Azure SAS tokens into logs.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/source-controller.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
