Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

external-dns, temporal-server-fips, vault could skip source address validation

published 11 days ago
Summary

The external-dns, temporal-server-fips, and vault packages can fail to verify the source IP address when a callback other than a public key is used, potentially allowing unauthorized connections. This means an attacker could bypass normal access controls and interact with the service from an unexpected location. Update to the latest patched versions or adjust the configuration to ensure only public‑key callbacks are accepted.

What to do
  • Update cleanstart external-dns to version 0.20.0-r2.
  • Update cleanstart temporal-server-fips to version 1.32.0-r2.
  • Update cleanstart vault to version 1.19.5-r6.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart external-dns < 0.20.0-r2
Fix: upgrade to 0.20.0-r2
CleanStart cleanstart temporal-server-fips < 1.32.0-r2
Fix: upgrade to 1.32.0-r2
CleanStart cleanstart vault < 1.19.5-r6
Fix: upgrade to 1.19.5-r6
Original advisory text
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Timeline
Published8 Oct 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-AM91695 · OSV
Track software like this
Free during beta