CLEANSTART-2026-TI30680

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-TI30680
Upstream
Published
2026-10-30T13:32:05Z
Modified
2026-10-31T01:01:49Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Security fix for GHSA-p77j-4mvh-x3m3 applied in: bank-vaults 1.32.1-r1, gitea 1.25.5-r0, minio 0.20250907.161309-r0, rclone 1.73.2-r0, openbao 2.5.4-r1, velero 1.16.2-r4, cortex 1.21.1-r2, cortex 1.21.1-r3, traefik 3.6.11-r4, smarter-device-manager 1.20.11-r1, smarter-device-manager 1.20.11-r2, velero-plugin-for-aws 1.11.1-r2, calico 3.31.4-r0, kube-state-metrics 2.16.0-r5, fulcio 1.8.7-r2, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, prometheus 3.9.1-r1
Details

GHSA-p77j-4mvh-x3m3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart
bank-vaults

Package

Name
bank-vaults
Purl
pkg:apk/cleanstart/bank-vaults

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.32.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
gitea

Package

Name
gitea
Purl
pkg:apk/cleanstart/gitea?arch=x86_64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.5-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
gitea

Package

Name
gitea
Purl
pkg:apk/cleanstart/gitea?arch=aarch64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.5-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
minio

Package

Name
minio
Purl
pkg:apk/cleanstart/minio

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.20250907.161309-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
rclone

Package

Name
rclone
Purl
pkg:apk/cleanstart/rclone

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.73.2-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
openbao

Package

Name
openbao
Purl
pkg:apk/cleanstart/openbao

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.5.4-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
velero

Package

Name
velero
Purl
pkg:apk/cleanstart/velero

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.2-r4

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
cortex

Package

Name
cortex
Purl
pkg:apk/cleanstart/cortex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.21.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
cortex

Package

Name
cortex
Purl
pkg:apk/cleanstart/cortex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.21.1-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
traefik

Package

Name
traefik
Purl
pkg:apk/cleanstart/traefik

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.6.11-r4

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
smarter-device-manager

Package

Name
smarter-device-manager
Purl
pkg:apk/cleanstart/smarter-device-manager

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.20.11-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
smarter-device-manager

Package

Name
smarter-device-manager
Purl
pkg:apk/cleanstart/smarter-device-manager

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.20.11-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
velero-plugin-for-aws

Package

Name
velero-plugin-for-aws
Purl
pkg:apk/cleanstart/velero-plugin-for-aws

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.11.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
calico

Package

Name
calico
Purl
pkg:apk/cleanstart/calico

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.31.4-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
kube-state-metrics

Package

Name
kube-state-metrics
Purl
pkg:apk/cleanstart/kube-state-metrics

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.16.0-r5

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
fulcio

Package

Name
fulcio
Purl
pkg:apk/cleanstart/fulcio

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.7-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
metrics-server

Package

Name
metrics-server
Purl
pkg:apk/cleanstart/metrics-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
metrics-server

Package

Name
metrics-server
Purl
pkg:apk/cleanstart/metrics-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"
prometheus

Package

Name
prometheus
Purl
pkg:apk/cleanstart/prometheus

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.9.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-TI30680.json"