Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

cleanstart/loki may execute unauthorized code

published 23 days ago
Summary

The loki component in the cleanstart/loki Go library has a weakness that could let an attacker cause it to run code they provide. This could lead to data leakage or system compromise. Update to the latest version of cleanstart/loki or apply the vendor's patch as soon as possible.

What to do
  • Update cleanstart loki to version 3.7.1-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart loki < 3.7.1-r0
Fix: upgrade to 3.7.1-r0
Original advisory text
OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-DU50032 · OSV
Track software like this
Free during beta