CLEANSTART-2026-WG30440

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-WG30440
Upstream
  • CVE-2026-56864
Published
2026-10-31T11:52:56Z
Modified
2026-10-31T16:30:33Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Details

CVE-2026-56864 affects multiple packages. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details.

References

Affected packages

CleanStart
traefik

Package

Name
traefik
Purl
pkg:apk/cleanstart/traefik

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.7.6-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"
cosign-fips

Package

Name
cosign-fips
Purl
pkg:apk/cleanstart/cosign-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.5.3-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"
cosign-fips

Package

Name
cosign-fips
Purl
pkg:apk/cleanstart/cosign-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.3-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"
opentofu

Package

Name
opentofu
Purl
pkg:apk/cleanstart/opentofu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.11.13-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"
opentofu

Package

Name
opentofu
Purl
pkg:apk/cleanstart/opentofu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.11.13-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"
opentofu

Package

Name
opentofu
Purl
pkg:apk/cleanstart/opentofu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.11.13-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"
coredns-fips

Package

Name
coredns-fips
Purl
pkg:apk/cleanstart/coredns-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.14.7-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"
cosign-fips

Package

Name
cosign-fips
Purl
pkg:apk/cleanstart/cosign-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.6-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-WG30440.json"