UnratedFix available

Release notes from flux2 v2.8.7

Type: patchSources: Flux

Flux v2.8.7 updates go-git to v5.19.0, which fixes CVE-2026-45022 in source-controller and image-automation-controller.

Products: image-automation-controller, source-controller
Affected versions: Not specified
Fixed versions: v1.1.3, v1.8.4
CVEs: CVE-2026-45022
Confirmed fixed CVEs: CVE-2026-45022
Updated in this feed: 28 Oct 2026, 11:23 UTC · Revision 1

Source evidence

Release notes from flux2 v2.8.7

github-fluxcd-flux2 · Original source

Published 12 May 2026, 11:45 UTC

Flux v2.8.7 updates go-git to v5.19.0, which fixes CVE-2026-45022 in source-controller and image-automation-controller.

Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)

source-controller

Fixed versions: v1.8.4

image-automation-controller

Fixed versions: v1.1.3

Complete source record

{
  "id": "b589d277c5854d94800d105db8146baa7b3d94e3e5dee626f8d6d1efc33fdb49",
  "url": "https://github.com/fluxcd/flux2/releases/tag/v2.8.7",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Release notes from flux2 v2.8.7",
    "summary": "Flux v2.8.7 updates go-git to v5.19.0, which fixes CVE-2026-45022 in source-controller and image-automation-controller.",
    "evidence": "Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)",
    "products": [
      {
        "name": {
          "value": "source-controller",
          "evidence": "Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v1.8.4",
            "evidence": "source-controller v1.8.4"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "image-automation-controller",
          "evidence": "Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v1.1.3",
            "evidence": "image-automation-controller v1.1.3"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-45022",
        "product": "source-controller",
        "evidence": "Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)"
      },
      {
        "cve": "CVE-2026-45022",
        "product": "image-automation-controller",
        "evidence": "Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)"
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-45022",
        "evidence": "Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-fluxcd-flux2",
  "document_id": 21170,
  "published_at": "2026-05-12T11:45:09+00:00"
}