flux2
v2.10.0Open and extensible continuous delivery solution for Kubernetes. Powered by GitOps Toolkit.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 7 advisories2 critical, 4 high, 1 medium · Scorecard 9.4/10
- Supported versions
- 3 lines supportednewest 2.10 · oldest 2.8 · 9 ended
8.5k stars · 812 forks · 246 open issues · last release 20 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 7 most recent advisories published by the maintainers: 2 critical, 4 high, 1 medium. Check the patched version against the one you run.
- highGHSA-mwcp-qpcg-fr7cAug 11, 2026Improper network isolation allows event spoofing, DoS and unauthorized status updates
- Affected
- < v2.9.3
- Patched in
- v2.9.4
- mediumCVE-2022-39272Oct 19, 2022Improper use of metav1.Duration allows for Denial of Service
- Affected
- < v0.35.0 >= v0.1.0; < v0.30.0 >= v0.0.1-alpha-1; < v0.29.0 >= v0.0.1-alpha-1; < v0.24.0 >= v0.0.1-alpha-1; < v0.27.0 >= v0.0.1-alpha-1; < v0.26.0 >= v0.1.0; < v0.22.0 >= v0.1.0
- Patched in
- v0.35.0; v0.30.0; v0.29.0; v0.24.0; v0.27.0; v0.26.0; v0.22.0
- highCVE-2022-36049Sep 7, 2022Helm Controller denial of service
- Affected
- < v0.23.0 >= v0.0.4; < v0.32.0 >= v0.0.17
- Patched in
- v0.23.0; v0.32.0
- highCVE-2022-36035Aug 31, 2022Flux CLI Workload Injection
- Affected
- < v0.32.0 >= v0.21.0
- Patched in
- v0.32.0
- highCVE-2022-24878May 4, 2022Improper path handling in Kustomization files allows for denial of service
- Affected
- < v0.24.0 >= v0.16.0; < v0.29.0 >= v0.19.0
- Patched in
- v0.29.0
- criticalCVE-2022-24877May 4, 2022Improper path handling in Kustomization files allows path traversal
- Affected
- < v0.24.0; < v0.29.0
- Patched in
- v0.24.0; v0.29.0
- criticalCVE-2022-24817May 4, 2022Improper kubeconfig validation allows arbitrary code execution
- Affected
- < v0.29.0 >= v0.1.0; < v0.23.0 >= v0.1.0; < v0.19.0 >= v0.2.0
- Patched in
- v0.29.0; v0.23.0; v0.19.0