CLEANSTART-2026-SQ71978

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-SQ71978
Upstream
  • CVE-2026-56864
Published
2026-10-30T13:11:23Z
Modified
2026-10-31T01:02:29Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Details

CVE-2026-56864 affects multiple packages. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details.

References

Affected packages

CleanStart
dex

Package

Name
dex
Purl
pkg:apk/cleanstart/dex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.43.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
opentelemetry-collector-contrib

Package

Name
opentelemetry-collector-contrib
Purl
pkg:apk/cleanstart/opentelemetry-collector-contrib

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.159.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
keda

Package

Name
keda
Purl
pkg:apk/cleanstart/keda

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.20.2-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
velero

Package

Name
velero
Purl
pkg:apk/cleanstart/velero

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.2-r9

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
prometheus-alertmanager

Package

Name
prometheus-alertmanager
Purl
pkg:apk/cleanstart/prometheus-alertmanager

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.32.2-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
opentofu

Package

Name
opentofu
Purl
pkg:apk/cleanstart/opentofu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.7-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
dex

Package

Name
dex
Purl
pkg:apk/cleanstart/dex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.42.1-r4

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
wave

Package

Name
wave
Purl
pkg:apk/cleanstart/wave

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cluster-autoscaler

Package

Name
cluster-autoscaler
Purl
pkg:apk/cleanstart/cluster-autoscaler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.35.2-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cluster-autoscaler

Package

Name
cluster-autoscaler
Purl
pkg:apk/cleanstart/cluster-autoscaler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cluster-autoscaler

Package

Name
cluster-autoscaler
Purl
pkg:apk/cleanstart/cluster-autoscaler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.1-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cluster-autoscaler

Package

Name
cluster-autoscaler
Purl
pkg:apk/cleanstart/cluster-autoscaler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.1-r6

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cluster-autoscaler

Package

Name
cluster-autoscaler
Purl
pkg:apk/cleanstart/cluster-autoscaler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.35.2-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cluster-autoscaler

Package

Name
cluster-autoscaler
Purl
pkg:apk/cleanstart/cluster-autoscaler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.35.2-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cluster-autoscaler

Package

Name
cluster-autoscaler
Purl
pkg:apk/cleanstart/cluster-autoscaler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
traefik

Package

Name
traefik
Purl
pkg:apk/cleanstart/traefik

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.6.25-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"
cosign

Package

Name
cosign
Purl
pkg:apk/cleanstart/cosign

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.5.3-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-SQ71978.json"