CLEANSTART-2026-HM91097

See a problem?

Import Source

https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json

JSON Data

https://api.osv.dev/v1/vulns/CLEANSTART-2026-HM91097

Upstream

GHSA-vgwf-h737-ff37

Published

2026-10-30T16:52:51Z

Modified

2026-10-31T01:00:34Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator

Summary

Security fix for GHSA-vgwf-h737-ff37 applied in: step-ca 0.30.2-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, melange 0.55.0-r1, litestream 0.5.14-r1, postgres-operator 1.12.2-r1, crossplane-provider-sql-fips 0.15.0-r2, kumactl 2.13.8-r1, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, argo-events 1.6.3-r1, vault-k8s-fips 1.7.5-r1

Details

GHSA-vgwf-h737-ff37 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart

step-ca

Package

Name: step-ca
Purl: pkg:apk/cleanstart/step-ca

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.30.2-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

litestream

Package

Name: litestream
Purl: pkg:apk/cleanstart/litestream?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.14-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

litestream

Package

Name: litestream
Purl: pkg:apk/cleanstart/litestream?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.14-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

litestream

Package

Name: litestream
Purl: pkg:apk/cleanstart/litestream?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.14-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

litestream

Package

Name: litestream
Purl: pkg:apk/cleanstart/litestream?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.14-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

melange

Package

Name: melange
Purl: pkg:apk/cleanstart/melange

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.55.0-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

litestream

Package

Name: litestream
Purl: pkg:apk/cleanstart/litestream?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.5.14-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

litestream

Package

Name: litestream
Purl: pkg:apk/cleanstart/litestream?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.5.14-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

postgres-operator

Package

Name: postgres-operator
Purl: pkg:apk/cleanstart/postgres-operator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.12.2-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

crossplane-provider-sql-fips

Package

Name: crossplane-provider-sql-fips
Purl: pkg:apk/cleanstart/crossplane-provider-sql-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.15.0-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

kumactl

Package

Name: kumactl
Purl: pkg:apk/cleanstart/kumactl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.13.8-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

promxy

Package

Name: promxy
Purl: pkg:apk/cleanstart/promxy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.96-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

cadvisor-fips

Package

Name: cadvisor-fips
Purl: pkg:apk/cleanstart/cadvisor-fips?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.60.3-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

cadvisor-fips

Package

Name: cadvisor-fips
Purl: pkg:apk/cleanstart/cadvisor-fips?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.60.3-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

consul-k8s-fips

Package

Name: consul-k8s-fips
Purl: pkg:apk/cleanstart/consul-k8s-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.8.14-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

argo-events

Package

Name: argo-events
Purl: pkg:apk/cleanstart/argo-events

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.3-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"

vault-k8s-fips

Package

Name: vault-k8s-fips
Purl: pkg:apk/cleanstart/vault-k8s-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.5-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HM91097.json"