Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

cleanstart packages may allow unauthorized access

published 10 days ago
Summary

Several cleanstart products, including the Prometheus Redis exporter, Ollama, Syft, and Node Problem Detector, have a flaw that can skip address checks, potentially letting attackers gain access without proper permission. This could expose sensitive data or allow malicious actions. Apply the latest updates from the vendor or follow their guidance to correct the configuration and restore proper validation.

What to do
  • Update cleanstart prometheus-redis-exporter-fips to version 1.91.1-r1.
  • Update cleanstart ollama-fips to version 0.40.0-r3.
  • Update cleanstart syft to version 1.52.0-r0.
  • Update cleanstart ollama-fips to version 0.34.4-r4.
  • Update cleanstart node-problem-detector to version 0.8.25-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart prometheus-redis-exporter-fips < 1.91.1-r1
Fix: upgrade to 1.91.1-r1
CleanStart cleanstart ollama-fips < 0.40.0-r3
< 0.34.4-r4
Fix: upgrade to 0.40.0-r3
CleanStart cleanstart syft < 1.52.0-r0
Fix: upgrade to 1.52.0-r0
CleanStart cleanstart node-problem-detector < 0.8.25-r1
Fix: upgrade to 0.8.25-r1
Original advisory text
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Timeline
Published9 Oct 2026
Updated9 Oct 2026
First seen9 Oct 2026
Sources
CLEANSTART-2026-BD72670 · OSV
Track software like this
Free during beta