CLEANSTART-2026-GQ95457

See a problem?

Import Source

https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json

JSON Data

https://api.osv.dev/v1/vulns/CLEANSTART-2026-GQ95457

Upstream

ghsa-vvgc-356p-c3xw

Published

2026-09-18T10:32:57Z

Modified

2026-09-18T11:45:56Z

Summary

Security fix for ghsa-vvgc-356p-c3xw applied in: calico-fips 3.27.5-r0, cfssl 1.5.0-r1, clickhouse-operator 0.25.5-r0, cortex-fips 0, cosign 2.4.3-r0, cosign 2.5.3-r0, distribution 3.0.0-r0, dynamic-localpv-provisioner 4.4.0-r0, external-dns-fips 0.16.1-r0, falcoctl 0.11.0-r0, go-fips-1.24 1.24.7-r0, go1.24 1.24.11-r0, harbor-fips 2.10.3-r0, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, kserve-modelmesh-serving 0.12.0-r1, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-rbac-proxy-fips 0.16.1-r0, kube-rbac-proxy-fips 0.17.1-r0, kube-rbac-proxy-fips 0.19.1-r0, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-fips 1.31.13-r0, kubernetes-fips 1.32.11-r0, kubernetes-fips 1.32.9-r0, kyverno-fips 1.13.6-r1, kyverno-fips 1.14.4-r2, local-static-provisioner 2.8.0-r0, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, multus-cni-fips 4.0.2-r2, nfs-subdir-external-provisioner-fips 4.0.17-r0, nfs-subdir-external-provisioner-fips 4.0.18-r1, opentofu-fips 1.9.4-r0, postgres-operator 1.12.2-r2, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.9.1-r0, prometheus-statsd-exporter 0.28.0-r0, prometheus-statsd-exporter-fips 0.28.0-r0, rabbitmq-messaging-topology-operator 1.15.0-r1, restic-fips 0.18.0-r0, runc 1.1.14-r0, tempo-fips 2.7.2-r0, vault-k8s-fips 1.7.0-r0, wave-fips 0.7.2-r1, wave-fips 0.8.0-r1, wave-fips 0.9.0-r1, wavefront-collector-for-kubernetes 1.13.0-r0, yunikorn-k8shim 1.7.0-r0, yunikorn-k8shim-fips 1.7.0-r0

Details

ghsa-vvgc-356p-c3xw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart

calico-fips

Package

Name: calico-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.27.5-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

cfssl

Package

Name: cfssl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

clickhouse-operator

Package

Name: clickhouse-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.25.5-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

cortex-fips

Package

Name: cortex-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

cosign

Package

Name: cosign

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

cosign

Package

Name: cosign

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

distribution

Package

Name: distribution

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

dynamic-localpv-provisioner

Package

Name: dynamic-localpv-provisioner

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.4.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

external-dns-fips

Package

Name: external-dns-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.16.1-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

falcoctl

Package

Name: falcoctl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.11.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

go-fips-1.24

Package

Name: go-fips-1.24

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.24.7-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

go1.24

Package

Name: go1.24

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.24.11-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

harbor-fips

Package

Name: harbor-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.10.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

harbor-fips

Package

Name: harbor-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.12.4-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

harbor-fips

Package

Name: harbor-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.13.2-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

harbor-registry

Package

Name: harbor-registry

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.0.1-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kserve-modelmesh-serving

Package

Name: kserve-modelmesh-serving

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.0-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kserve-rest-proxy

Package

Name: kserve-rest-proxy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.0-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kube-fluentd-operator

Package

Name: kube-fluentd-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.18.2-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kube-rbac-proxy-fips

Package

Name: kube-rbac-proxy-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.16.1-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kube-rbac-proxy-fips

Package

Name: kube-rbac-proxy-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.17.1-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kube-rbac-proxy-fips

Package

Name: kube-rbac-proxy-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.19.1-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kube-state-metrics-fips

Package

Name: kube-state-metrics-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.14.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kube-state-metrics-fips

Package

Name: kube-state-metrics-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.15.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kubernetes-csi-node-driver-registrar

Package

Name: kubernetes-csi-node-driver-registrar

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.13.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kubernetes-fips

Package

Name: kubernetes-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.31.13-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kubernetes-fips

Package

Name: kubernetes-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.32.11-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kubernetes-fips

Package

Name: kubernetes-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.32.9-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kyverno-fips

Package

Name: kyverno-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.13.6-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

kyverno-fips

Package

Name: kyverno-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.14.4-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

local-static-provisioner

Package

Name: local-static-provisioner

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.8.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

modelmesh-runtime-adapter

Package

Name: modelmesh-runtime-adapter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

modelmesh-runtime-adapter

Package

Name: modelmesh-runtime-adapter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.0-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

multus-cni-fips

Package

Name: multus-cni-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.0.2-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

nfs-subdir-external-provisioner-fips

Package

Name: nfs-subdir-external-provisioner-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.0.17-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

nfs-subdir-external-provisioner-fips

Package

Name: nfs-subdir-external-provisioner-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.0.18-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

opentofu-fips

Package

Name: opentofu-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.9.4-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

postgres-operator

Package

Name: postgres-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.12.2-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.8.0-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

prometheus-node-exporter-fips

Package

Name: prometheus-node-exporter-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.9.1-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

prometheus-statsd-exporter

Package

Name: prometheus-statsd-exporter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.28.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

prometheus-statsd-exporter-fips

Package

Name: prometheus-statsd-exporter-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.28.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

rabbitmq-messaging-topology-operator

Package

Name: rabbitmq-messaging-topology-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.15.0-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

restic-fips

Package

Name: restic-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.18.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

runc

Package

Name: runc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.1.14-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

tempo-fips

Package

Name: tempo-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.2-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

vault-k8s-fips

Package

Name: vault-k8s-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

wave-fips

Package

Name: wave-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.7.2-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

wave-fips

Package

Name: wave-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.8.0-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

wave-fips

Package

Name: wave-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.9.0-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

wavefront-collector-for-kubernetes

Package

Name: wavefront-collector-for-kubernetes

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.13.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

yunikorn-k8shim

Package

Name: yunikorn-k8shim

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"

yunikorn-k8shim-fips

Package

Name: yunikorn-k8shim-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GQ95457.json"