CVE-2026-47680: Vulnerability in github.com/fluxcd/source-controller Allows Path Traversal
Summary
CVE-2026-47680: Source controller: Improper path handling allows traversal in github.com/fluxcd/source-controller. Affects github.com/fluxcd/source-controller versions >= 0.0.17, < 1.8.5. Fixed in 1.8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/fluxcd/source-controller is a Go-based package that facilitates the management of source code repositories in a Kubernetes environment. It enables users to automate the synchronization of their Git repositories with Kubernetes clusters, providing a streamlined workflow for continuous deployment. However, this package has been found to have a vulnerability that can lead to unauthorized access to files outside the intended directory structure.
Vulnerability Detail
The vulnerability identified as CVE-2026-47680 stems from improper path handling within the source controller. This flaw allows attackers to exploit the system by performing path traversal attacks, potentially gaining access to sensitive files and directories that should be restricted. The ramifications of this vulnerability can include unauthorized data exposure, data manipulation, and compromise of the overall security of the Kubernetes environment.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/fluxcd/source-controller@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.5
This is the first release that contains the fix.
go get github.com/fluxcd/source-controller@v1.8.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the patched version immediately, a temporary workaround is to implement strict input validation on file paths used within the application to prevent traversal attempts. Ensure that any user-supplied paths are sanitized and checked against a whitelist of allowed directories.
Conclusion
The CVE-2026-47680 vulnerability in the github.com/fluxcd/source-controller package poses a significant risk due to improper path handling that allows for path traversal. It is crucial to update to the patched version 1.8.5 or later to secure your application. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for github.com/fluxcd/source-controller →
FAQ
CVE-2026-47680 is a vulnerability in the github.com/fluxcd/source-controller package that allows for path traversal due to improper path handling.
This vulnerability can lead to unauthorized access to sensitive files and directories, potentially compromising the security of your application and data.
You should update the github.com/fluxcd/source-controller package to version 1.8.5 or later to mitigate the vulnerability.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without needing access to the code or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/source-controller.
