CVE-2026-47680

Name of the Vulnerable Software and Affected Versions source-controller versions prior to 1.8.5

Description Improper path handling allows for path traversal in two scenarios. First, an actor capable of influencing the contents of a bucket referenced by a Bucket resource can force the source-controller to write fetched object data to paths outside the per-reconciliation working directory. While digest verification by the source-controller and downstream controllers (kustomize-controller, helm-controller) prevents manipulated artifacts from reaching the cluster, an attacker can still write files to any location where the source-controller pod has write permissions. Second, in versions 1.6.0 and later, a user with permissions to create or update GitRepository resources can use the sparse-checkout feature to test for the existence of paths outside the cloned repository, allowing limited enumeration of file paths on the controller pod via the resource status.

Recommendations Update source-controller to version 1.8.5. As a defense-in-depth measure for the GitRepository sparse-checkout issue, deploy a ValidatingAdmissionPolicy to reject GitRepository resources where .spec.sparseCheckout entries contain absolute path segments or .. sequences.