FluxCD: SSRF via notification-controller `Provider.spec.address`

[llooFlashooll]

It is an false positive and I just removed it. Sorry for any trouble.

[matheuscscp]

@llooFlashooll Next time you try to disclose a CVE not following the secret disclosure process you're going to be banned from the fluxcd org

[llooFlashooll]

No problem sir! @matheuscscp Actually I have privately disclosed through emails, but no one replied me for more than a week. 😢

[matheuscscp]

@llooFlashooll That's because we receive tons of false-positive SSRF reports for .spec.{address|url} that we need to go over, plus a bunch of AI slop. Your report not getting a reply there does not warrant you coming here and doing what you did, especially in the age of scoring things easily with AI.

[matheuscscp]

Reopened the issue, we will close it with a section here: https://fluxcd.io/flux/security/best-practices/

This is not a problem that should be solved in Flux. Instead, users should use ValidatingAdmissionPolicy to enforce trusted addresses. I will open a PR in the website to add this section and close this issue.