CLEANSTART-2026-OJ05849

See a problem?

Import Source

https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json

JSON Data

https://api.osv.dev/v1/vulns/CLEANSTART-2026-OJ05849

Upstream

GHSA-259r-337f-4rfw

Published

2026-10-30T13:26:40Z

Modified

2026-10-31T01:02:13Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Security fix for GHSA-259r-337f-4rfw applied in: loki 3.7.1-r2, keda 2.20.2-r0, knative-serving 1.21.3-r0, velero 1.16.2-r15, velero 1.16.2-r8, prometheus 3.5.3-r12, prometheus 3.5.3-r8, temporal-server 1.30.6-r1, temporal-server 1.30.6-r2, temporal-server 1.30.8-r1, temporal-server-fips 1.31.4-r1, mongodb 8.1.3-r2, weaviate-fips 1.36.23-r2, kubernetes-event-exporter 1.4-r0, rancher-fleet-agent 0.13.16-r1, thanos 0.40.1-r3, thanos 0.41.0-r2, prometheus 3.5.3-r9, thanos 0.39.2-r4, cadvisor 0.55.1-r3, step-issuer 0.10.2-r3

Details

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart

loki

Package

Name: loki
Purl: pkg:apk/cleanstart/loki?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.7.1-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

loki

Package

Name: loki
Purl: pkg:apk/cleanstart/loki?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.7.1-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

loki

Package

Name: loki
Purl: pkg:apk/cleanstart/loki?arch=ppc64le

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.7.1-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

loki

Package

Name: loki
Purl: pkg:apk/cleanstart/loki?arch=loongarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.7.1-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

keda

Package

Name: keda
Purl: pkg:apk/cleanstart/keda

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.20.2-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

knative-serving

Package

Name: knative-serving
Purl: pkg:apk/cleanstart/knative-serving?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.21.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

knative-serving

Package

Name: knative-serving
Purl: pkg:apk/cleanstart/knative-serving?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.21.3-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

velero

Package

Name: velero
Purl: pkg:apk/cleanstart/velero

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.16.2-r15

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

velero

Package

Name: velero
Purl: pkg:apk/cleanstart/velero

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.16.2-r8

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

prometheus

Package

Name: prometheus
Purl: pkg:apk/cleanstart/prometheus

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.5.3-r12

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

prometheus

Package

Name: prometheus
Purl: pkg:apk/cleanstart/prometheus

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.5.3-r8

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

temporal-server

Package

Name: temporal-server
Purl: pkg:apk/cleanstart/temporal-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.30.6-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

temporal-server

Package

Name: temporal-server
Purl: pkg:apk/cleanstart/temporal-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.30.6-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

temporal-server

Package

Name: temporal-server
Purl: pkg:apk/cleanstart/temporal-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.30.8-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

temporal-server-fips

Package

Name: temporal-server-fips
Purl: pkg:apk/cleanstart/temporal-server-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.31.4-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

mongodb

Package

Name: mongodb
Purl: pkg:apk/cleanstart/mongodb?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.1.3-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

mongodb

Package

Name: mongodb
Purl: pkg:apk/cleanstart/mongodb?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.1.3-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

weaviate-fips

Package

Name: weaviate-fips
Purl: pkg:apk/cleanstart/weaviate-fips

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.36.23-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

kubernetes-event-exporter

Package

Name: kubernetes-event-exporter
Purl: pkg:apk/cleanstart/kubernetes-event-exporter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.4-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

rancher-fleet-agent

Package

Name: rancher-fleet-agent
Purl: pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.16-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

thanos

Package

Name: thanos
Purl: pkg:apk/cleanstart/thanos

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.40.1-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

thanos

Package

Name: thanos
Purl: pkg:apk/cleanstart/thanos

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.41.0-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

prometheus

Package

Name: prometheus
Purl: pkg:apk/cleanstart/prometheus

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.5.3-r9

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

thanos

Package

Name: thanos
Purl: pkg:apk/cleanstart/thanos

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.39.2-r4

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

cadvisor

Package

Name: cadvisor
Purl: pkg:apk/cleanstart/cadvisor?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.55.1-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

cadvisor

Package

Name: cadvisor
Purl: pkg:apk/cleanstart/cadvisor?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.55.1-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"

step-issuer

Package

Name: step-issuer
Purl: pkg:apk/cleanstart/step-issuer

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.10.2-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OJ05849.json"