CLEANSTART-2026-CL56370

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-CL56370
Upstream
Published
2026-10-30T13:32:16Z
Modified
2026-10-31T01:01:54Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Security fix for GHSA-hfvc-g4fc-pqhx applied in: kube-state-metrics 2.18.0-r2, bank-vaults 1.32.1-r1, etcd 3.6.10-r0, grafana 13.0.0-r0, minio 0.20250907.161309-r3, openbao 2.5.4-r1, velero 1.16.2-r4, argo-cd-fips 3.3.7-r0, temporal-server-fips 1.31.1-r1, kube-state-metrics 2.17.0-r1, cortex 1.21.1-r2, cortex 1.21.1-r3, thanos 0.41.0-r0, fulcio 1.8.7-r2, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, prometheus 3.10.0-r1
Details

GHSA-hfvc-g4fc-pqhx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart
kube-state-metrics

Package

Name
kube-state-metrics
Purl
pkg:apk/cleanstart/kube-state-metrics

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.18.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
bank-vaults

Package

Name
bank-vaults
Purl
pkg:apk/cleanstart/bank-vaults

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.32.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
etcd

Package

Name
etcd
Purl
pkg:apk/cleanstart/etcd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.6.10-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
grafana

Package

Name
grafana
Purl
pkg:apk/cleanstart/grafana

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
13.0.0-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
minio

Package

Name
minio
Purl
pkg:apk/cleanstart/minio

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.20250907.161309-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
openbao

Package

Name
openbao
Purl
pkg:apk/cleanstart/openbao

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.5.4-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
velero

Package

Name
velero
Purl
pkg:apk/cleanstart/velero

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.2-r4

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
argo-cd-fips

Package

Name
argo-cd-fips
Purl
pkg:apk/cleanstart/argo-cd-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.3.7-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
temporal-server-fips

Package

Name
temporal-server-fips
Purl
pkg:apk/cleanstart/temporal-server-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.31.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
kube-state-metrics

Package

Name
kube-state-metrics
Purl
pkg:apk/cleanstart/kube-state-metrics

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.17.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
cortex

Package

Name
cortex
Purl
pkg:apk/cleanstart/cortex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.21.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
cortex

Package

Name
cortex
Purl
pkg:apk/cleanstart/cortex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.21.1-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
thanos

Package

Name
thanos
Purl
pkg:apk/cleanstart/thanos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.41.0-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
fulcio

Package

Name
fulcio
Purl
pkg:apk/cleanstart/fulcio

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.7-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
metrics-server

Package

Name
metrics-server
Purl
pkg:apk/cleanstart/metrics-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
metrics-server

Package

Name
metrics-server
Purl
pkg:apk/cleanstart/metrics-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"
prometheus

Package

Name
prometheus
Purl
pkg:apk/cleanstart/prometheus

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.10.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CL56370.json"