Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
Prometheus Redis Exporter and Temporal Server may skip address checks
published 13 days ago
Summary
Both the Prometheus Redis Exporter (FIPS version) and Temporal Server can incorrectly skip verification of where a connection originates when a non‑public‑key method is used. This could let an attacker gain access or perform actions they shouldn’t. Update to the latest patched versions as soon as possible to restore proper address validation.
What to do
- Update cleanstart prometheus-redis-exporter-fips to version 1.92.1-r0.
- Update cleanstart temporal-server to version 1.31.3-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | prometheus-redis-exporter-fips |
< 1.92.1-r0 Fix: upgrade to 1.92.1-r0
|
| CleanStart | cleanstart | temporal-server |
< 1.31.3-r1 Fix: upgrade to 1.31.3-r1
|
Original advisory text
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability details.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-YR68258 · OSV
Track software like this
Free during beta