Flux

v2.9.4CI/CD & App Delivery

Aug 7, 2026Copy link

Flux v2.9.4 is a security patch addressing five validation and resource-limit issues across components (tarball extraction, refspec handling, HTTP request limits, OCI digest pinning, GCS authentication scoping) and includes CRD schema changes for ArtifactGenerator and ImageUpdateAutomation that require a coordinated upgrade.

• securityTarball extraction and glob bounds tightened

  Tarball extraction and glob expansion in source-watcher are now bounded to prevent directory traversal and resource exhaustion. The fix ships in v2.2.3 and applies to all Flux installations.

• securityImageUpdateAutomation refspec force-update and deletion blocked

  ImageUpdateAutomation no longer allows force-update or deletion directives via refspecs, preventing unintended overwrite of Git history. The fix ships in v1.2.4 and applies if ImageUpdateAutomation is used.

• securityHTTP server request limits unified

  HTTP server request limits in notification-controller are now unified to prevent resource exhaustion from oversized requests. The fix ships in v1.9.3 and applies to all Flux installations.

• securityOCI chart verification pinned by digest

  OCI chart verification in source-controller now requires digest pinning, preventing substitution of unsigned or modified charts. The fix ships in v1.9.4 and applies if OCI charts are verified.

• securityGCS static authentication scoped to service account keys

  GCS static authentication in Bucket sources is now scoped to service account keys only, blocking credential types that could grant unintended access. The fix ships in v1.9.4 and applies if Bucket sources use GCS static authentication.

• breakingCRD schema updates for ArtifactGenerator and ImageUpdateAutomation

  CRD schema has changed for ArtifactGenerator and ImageUpdateAutomation. Both CRDs must be updated when upgrading the controllers; a coordinated CRD and controller upgrade is required to avoid compatibility issues.