CLEANSTART-2026-AX22930

See a problem?

Import Source

https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json

JSON Data

https://api.osv.dev/v1/vulns/CLEANSTART-2026-AX22930

Upstream

CVE-2025-30204

Published

2026-09-18T10:24:10Z

Modified

2026-10-09T07:45:13Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Security fix for CVE-2025-30204 applied in: argo-rollouts 1.9.0-r0, argo-rollouts-fips 1.9.0-r0, boring-registry-fips 0.15.5-r2, cosign 2.4.3-r0, cosign 2.5.3-r0, fulcio 1.5.1-r0, fulcio-fips 1.5.1-r1, fulcio-fips 1.6.6-r1, minio-operator 6.0.4-r5, minio-operator 7.0.1-r3, prometheus 2.47.2-r0, prometheus-operator 0.69.1-r0, rclone 1.69.0-r0, step-ca 0.27.5-r0, step-cli 0.27.5-r1, tempo 2.7.2-r0, tempo 2.8.3-r0, tempo-fips 2.7.2-r0, velero-plugin-for-csi 0.6.3-r1

Details

CVE-2025-30204 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart

argo-rollouts

Package

Name: argo-rollouts
Purl: pkg:apk/cleanstart/argo-rollouts

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.9.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

argo-rollouts-fips

Package

Name: argo-rollouts-fips
Purl: pkg:apk/cleanstart/argo-rollouts-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.9.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

boring-registry-fips

Package

Name: boring-registry-fips
Purl: pkg:apk/cleanstart/boring-registry-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.15.5-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

cosign

Package

Name: cosign
Purl: pkg:apk/cleanstart/cosign

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

cosign

Package

Name: cosign
Purl: pkg:apk/cleanstart/cosign

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

fulcio

Package

Name: fulcio
Purl: pkg:apk/cleanstart/fulcio

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.1-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

fulcio-fips

Package

Name: fulcio-fips
Purl: pkg:apk/cleanstart/fulcio-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.1-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

fulcio-fips

Package

Name: fulcio-fips
Purl: pkg:apk/cleanstart/fulcio-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.6-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

minio-operator

Package

Name: minio-operator
Purl: pkg:apk/cleanstart/minio-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.0.4-r5

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

minio-operator

Package

Name: minio-operator
Purl: pkg:apk/cleanstart/minio-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.0.1-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

prometheus

Package

Name: prometheus
Purl: pkg:apk/cleanstart/prometheus

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.47.2-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

prometheus-operator

Package

Name: prometheus-operator
Purl: pkg:apk/cleanstart/prometheus-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.69.1-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

rclone

Package

Name: rclone
Purl: pkg:apk/cleanstart/rclone

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.69.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

step-ca

Package

Name: step-ca
Purl: pkg:apk/cleanstart/step-ca

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.27.5-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

step-cli

Package

Name: step-cli
Purl: pkg:apk/cleanstart/step-cli

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.27.5-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

tempo

Package

Name: tempo
Purl: pkg:apk/cleanstart/tempo

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.2-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

tempo

Package

Name: tempo
Purl: pkg:apk/cleanstart/tempo

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.8.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

tempo-fips

Package

Name: tempo-fips
Purl: pkg:apk/cleanstart/tempo-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.2-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"

velero-plugin-for-csi

Package

Name: velero-plugin-for-csi
Purl: pkg:apk/cleanstart/velero-plugin-for-csi

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.6.3-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-AX22930.json"