CLEANSTART-2026-WG10458

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-WG10458
Upstream
Published
2026-10-30T17:06:48Z
Modified
2026-10-31T01:02:24Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Security fix for GHSA-hrxh-6v49-42gf applied in: rancher-fleet-agent 0.15.4-r1, rancher-fleet-agent 0.15.4-r2, newrelic-infrastructure-agent 1.78.1-r2, lvm-driver 1.10.0-r1, lvm-driver 1.10.0-r2, rancher-fleet-agent 0.12.17-r1, rancher-fleet-agent 0.12.17-r2, rancher-fleet-agent 0.13.13-r0, fulcio-fips 1.5.1-r1, fluent-operator-fips 3.10.0-r2, rancher-fleet-agent 0.14.8-r1, rancher-fleet-agent 0.14.8-r2, temporal-server 1.28.4-r1, temporal-server 1.29.7-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, tempo-fips 3.0.2-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-csi-external-resizer-fips 2.2.1-r1, promxy 0.0.96-r3, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, multus-cni-fips 4.3.0-r1
Details

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart
rancher-fleet-agent

Package

Name
rancher-fleet-agent
Purl
pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.15.4-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
rancher-fleet-agent

Package

Name
rancher-fleet-agent
Purl
pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.15.4-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
newrelic-infrastructure-agent

Package

Name
newrelic-infrastructure-agent
Purl
pkg:apk/cleanstart/newrelic-infrastructure-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.78.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
lvm-driver

Package

Name
lvm-driver
Purl
pkg:apk/cleanstart/lvm-driver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.10.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
lvm-driver

Package

Name
lvm-driver
Purl
pkg:apk/cleanstart/lvm-driver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.10.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
rancher-fleet-agent

Package

Name
rancher-fleet-agent
Purl
pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.17-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
rancher-fleet-agent

Package

Name
rancher-fleet-agent
Purl
pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.17-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
rancher-fleet-agent

Package

Name
rancher-fleet-agent
Purl
pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.13.13-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
fulcio-fips

Package

Name
fulcio-fips
Purl
pkg:apk/cleanstart/fulcio-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
fluent-operator-fips

Package

Name
fluent-operator-fips
Purl
pkg:apk/cleanstart/fluent-operator-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.10.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
rancher-fleet-agent

Package

Name
rancher-fleet-agent
Purl
pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.14.8-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
rancher-fleet-agent

Package

Name
rancher-fleet-agent
Purl
pkg:apk/cleanstart/rancher-fleet-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.14.8-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
temporal-server

Package

Name
temporal-server
Purl
pkg:apk/cleanstart/temporal-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.28.4-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
temporal-server

Package

Name
temporal-server
Purl
pkg:apk/cleanstart/temporal-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.29.7-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
litestream

Package

Name
litestream
Purl
pkg:apk/cleanstart/litestream?arch=x86_64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.3.14-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
litestream

Package

Name
litestream
Purl
pkg:apk/cleanstart/litestream?arch=aarch64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.3.14-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
litestream

Package

Name
litestream
Purl
pkg:apk/cleanstart/litestream?arch=x86_64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.3.14-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
litestream

Package

Name
litestream
Purl
pkg:apk/cleanstart/litestream?arch=aarch64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.3.14-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
metrics-server-fips

Package

Name
metrics-server-fips
Purl
pkg:apk/cleanstart/metrics-server-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
trillian-fips

Package

Name
trillian-fips
Purl
pkg:apk/cleanstart/trillian-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.7.3-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
distribution

Package

Name
distribution
Purl
pkg:apk/cleanstart/distribution

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
melange

Package

Name
melange
Purl
pkg:apk/cleanstart/melange

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.55.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
tempo-fips

Package

Name
tempo-fips
Purl
pkg:apk/cleanstart/tempo-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.2-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
consul-fips

Package

Name
consul-fips
Purl
pkg:apk/cleanstart/consul-fips?arch=aarch64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
consul-fips

Package

Name
consul-fips
Purl
pkg:apk/cleanstart/consul-fips?arch=x86_64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
crossplane-provider-sql-fips

Package

Name
crossplane-provider-sql-fips
Purl
pkg:apk/cleanstart/crossplane-provider-sql-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.15.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
crossplane-provider-sql-fips

Package

Name
crossplane-provider-sql-fips
Purl
pkg:apk/cleanstart/crossplane-provider-sql-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.15.0-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
falco-exporter

Package

Name
falco-exporter
Purl
pkg:apk/cleanstart/falco-exporter

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.7-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
k8sgpt-operator

Package

Name
k8sgpt-operator
Purl
pkg:apk/cleanstart/k8sgpt-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.2.27-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
kubernetes-csi-external-resizer-fips

Package

Name
kubernetes-csi-external-resizer-fips
Purl
pkg:apk/cleanstart/kubernetes-csi-external-resizer-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
promxy

Package

Name
promxy
Purl
pkg:apk/cleanstart/promxy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.96-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
promxy

Package

Name
promxy
Purl
pkg:apk/cleanstart/promxy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.96-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
cadvisor-fips

Package

Name
cadvisor-fips
Purl
pkg:apk/cleanstart/cadvisor-fips?arch=x86_64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.60.3-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
cadvisor-fips

Package

Name
cadvisor-fips
Purl
pkg:apk/cleanstart/cadvisor-fips?arch=aarch64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.60.3-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
consul-k8s-fips

Package

Name
consul-k8s-fips
Purl
pkg:apk/cleanstart/consul-k8s-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.14-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
distribution-fips

Package

Name
distribution-fips
Purl
pkg:apk/cleanstart/distribution-fips?arch=aarch64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
distribution-fips

Package

Name
distribution-fips
Purl
pkg:apk/cleanstart/distribution-fips?arch=x86_64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
kaniko

Package

Name
kaniko
Purl
pkg:apk/cleanstart/kaniko?arch=x86_64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.24.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
kaniko

Package

Name
kaniko
Purl
pkg:apk/cleanstart/kaniko?arch=aarch64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.24.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
prometheus-adapter

Package

Name
prometheus-adapter
Purl
pkg:apk/cleanstart/prometheus-adapter

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
yunikorn-k8shim-fips

Package

Name
yunikorn-k8shim-fips
Purl
pkg:apk/cleanstart/yunikorn-k8shim-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"
multus-cni-fips

Package

Name
multus-cni-fips
Purl
pkg:apk/cleanstart/multus-cni-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG10458.json"