CVE-2021-41254: Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
Summary
CVE-2021-41254: Privilege escalation to cluster admin on multi-tenant environments. Affects github.com/fluxcd/kustomize-controller versions < 0.15.0. Fixed in 0.15.0. How to fix ↓
Also tracked for
- kustomize · Bitnami
The same CVE-2021-41254 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/fluxcd/kustomize-controller package is a component of Flux, a popular GitOps tool for Kubernetes. It is responsible for managing Kustomize-based deployments in multi-tenant environments. Kustomize is a tool used to customize Kubernetes configurations by applying overlays to base manifests. The kustomize-controller allows users to define Kustomization objects that specify the desired state of their deployments. These objects are reconciled by the controller to ensure the actual state matches the desired state.
Vulnerability Detail
This vulnerability allows users with the ability to create Kubernetes Secrets, Service Accounts, and Flux Kustomization objects to execute arbitrary commands inside the kustomize-controller container. By embedding a shell script in a Kubernetes Secret, an attacker can run kubectl commands under the Service Account of the kustomize-controller, granting them cluster admin privileges. This vulnerability affects multi-tenant environments where non-admin users have permissions to create Flux Kustomization objects.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/fluxcd/kustomize-controller@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.15.0
This is the first release that contains the fix.
go get github.com/fluxcd/kustomize-controller@v0.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To prevent the creation of Kubernetes Service Accounts with secrets in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used. An example workaround using Kyverno is provided:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: restrict-sa
spec:
validationFailureAction: enforce
background: false
rules:
- name: validate-sa
match:
resources:
kinds:
- ServiceAccount
namespaces:
- tenant1
- tenant2
subjects:
- kind: User
name: some@tenant1.com
- kind: User
name: some@tenant2.com
- kind: ServiceAccount
name: kustomize-controller
namespace: flux-system
- kind: ServiceAccount
name: helm-controller
namespace: flux-system
validate:
message: "Invalid service account"
pattern:
X(secrets): "*?"
Conclusion
The vulnerability in github.com/fluxcd/kustomize-controller allows privilege escalation to cluster admin on multi-tenant environments. It can be mitigated by updating to the fixed version of kustomize-controller. Users can also implement a workaround using a Kubernetes validation webhook. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/fluxcd/kustomize-controller →
FAQ
Multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected.
An attacker can create a Kubernetes Secret with a shell command, create a Service Account that refers to the secret, and create a Kustomization that runs under the Service Account. When the kustomize-controller reconciles the Kustomization, it will execute the shell command from the secret.
By exploiting this vulnerability, an authenticated Kubernetes user can gain cluster admin privileges, allowing them to perform unauthorized actions and potentially compromise the entire cluster.
Yes, the vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. The fix removes the ability to execute shell commands and removes the kubectl binary from the container image.
Yes, a workaround is to use a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno to prevent the creation of Kubernetes Service Accounts with secrets in tenant-owned namespaces.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/kustomize-controller.
