CLEANSTART-2026-YV22995

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-YV22995
Upstream
  • ghsa-f5wc-c3c7-36mc
Published
2026-09-18T09:52:49Z
Modified
2026-10-09T07:47:42Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Security fix for ghsa-f5wc-c3c7-36mc applied in: amazon-cloudwatch-agent 1.300065.0-r1, bank-vaults 1.32.1-r1, cfssl 1.5.0-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r3, distribution 3.1.1-r1, distribution-fips 3.1.1-r1, flux-image-automation-controller 1.2.1-r1, fulcio 1.8.7-r2, fulcio-fips 1.8.7-r1, grafana-agent-operator 0.44.3-r1, kaniko 1.24.0-r2, kubernetes 1.34.10-r2, kubernetes-dns-node-cache-fips 1.25.0-r1, metrics-server-fips 0.8.1-r3, node-problem-detector 1.35.2-r1, postgres-operator 1.12.2-r2, prometheus-adapter 0.12.0-r1, promxy 0.0.96-r3, step-ca-fips 0.30.2-r1, syft 1.43.0-r1, temporal-ui-server-fips 2.51.1-r1, trillian-fips 1.7.3-r1, yunikorn-k8shim 1.8.0-r1, yunikorn-k8shim-fips 1.8.0-r2
Details

ghsa-f5wc-c3c7-36mc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

Affected packages

CleanStart
amazon-cloudwatch-agent

Package

Name
amazon-cloudwatch-agent
Purl
pkg:apk/cleanstart/amazon-cloudwatch-agent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.300065.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
bank-vaults

Package

Name
bank-vaults
Purl
pkg:apk/cleanstart/bank-vaults

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.32.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
cfssl

Package

Name
cfssl
Purl
pkg:apk/cleanstart/cfssl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
consul-fips

Package

Name
consul-fips
Purl
pkg:apk/cleanstart/consul-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
crossplane-provider-sql-fips

Package

Name
crossplane-provider-sql-fips
Purl
pkg:apk/cleanstart/crossplane-provider-sql-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.15.0-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
distribution

Package

Name
distribution
Purl
pkg:apk/cleanstart/distribution

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
distribution-fips

Package

Name
distribution-fips
Purl
pkg:apk/cleanstart/distribution-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
flux-image-automation-controller

Package

Name
flux-image-automation-controller
Purl
pkg:apk/cleanstart/flux-image-automation-controller

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
fulcio

Package

Name
fulcio
Purl
pkg:apk/cleanstart/fulcio

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.7-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
fulcio-fips

Package

Name
fulcio-fips
Purl
pkg:apk/cleanstart/fulcio-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.7-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
grafana-agent-operator

Package

Name
grafana-agent-operator
Purl
pkg:apk/cleanstart/grafana-agent-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.44.3-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
kaniko

Package

Name
kaniko
Purl
pkg:apk/cleanstart/kaniko

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.24.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
kubernetes

Package

Name
kubernetes
Purl
pkg:apk/cleanstart/kubernetes

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.34.10-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
kubernetes-dns-node-cache-fips

Package

Name
kubernetes-dns-node-cache-fips
Purl
pkg:apk/cleanstart/kubernetes-dns-node-cache-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
metrics-server-fips

Package

Name
metrics-server-fips
Purl
pkg:apk/cleanstart/metrics-server-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
node-problem-detector

Package

Name
node-problem-detector
Purl
pkg:apk/cleanstart/node-problem-detector

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.35.2-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
postgres-operator

Package

Name
postgres-operator
Purl
pkg:apk/cleanstart/postgres-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.2-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
prometheus-adapter

Package

Name
prometheus-adapter
Purl
pkg:apk/cleanstart/prometheus-adapter

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
promxy

Package

Name
promxy
Purl
pkg:apk/cleanstart/promxy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.96-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
step-ca-fips

Package

Name
step-ca-fips
Purl
pkg:apk/cleanstart/step-ca-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.30.2-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
syft

Package

Name
syft
Purl
pkg:apk/cleanstart/syft

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.43.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
temporal-ui-server-fips

Package

Name
temporal-ui-server-fips
Purl
pkg:apk/cleanstart/temporal-ui-server-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.51.1-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
trillian-fips

Package

Name
trillian-fips
Purl
pkg:apk/cleanstart/trillian-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.7.3-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
yunikorn-k8shim

Package

Name
yunikorn-k8shim
Purl
pkg:apk/cleanstart/yunikorn-k8shim

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"
yunikorn-k8shim-fips

Package

Name
yunikorn-k8shim-fips
Purl
pkg:apk/cleanstart/yunikorn-k8shim-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.0-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-YV22995.json"