Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

cleanstart components allow unauthorized access via SSH callback

published 4 days ago
Summary

The cleanstart/ollama-fips, cleanstart/prometheus-mysqld-exporter, cleanstart/nfs-subdir-external-provisioner, and cleanstart/external-dns packages have a flaw where, if an SSH connection uses a callback other than a public key, the server skips verifying the source address. This could let an attacker connect from an unexpected location and gain access. Apply the latest updates or reconfigure the SSH settings to accept only public‑key callbacks and enforce proper address validation.

What to do
  • Update cleanstart ollama-fips to version 0.40.3-r1.
  • Update cleanstart prometheus-mysqld-exporter to version 0.20.0-r4.
  • Update cleanstart nfs-subdir-external-provisioner to version 4.0.18-r3.
  • Update cleanstart external-dns to version 0.20.0-r3.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart ollama-fips < 0.40.3-r1
Fix: upgrade to 0.40.3-r1
CleanStart cleanstart prometheus-mysqld-exporter < 0.20.0-r4
Fix: upgrade to 0.20.0-r4
CleanStart cleanstart nfs-subdir-external-provisioner < 4.0.18-r3
Fix: upgrade to 4.0.18-r3
CleanStart cleanstart external-dns < 0.20.0-r3
Fix: upgrade to 0.20.0-r3
Original advisory text
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLEANSTART-2026-TJ76874 · OSV
Track software like this
Free during beta