Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
cleanstart/loki may let attackers change remote key rules
published 23 days ago
Summary
The loki software from cleanstart can be tricked when a new key is added to a remote agent, allowing someone to modify the rules that limit where connections can go. This could let an attacker redirect traffic or bypass intended restrictions. Apply the latest security update from the vendor or remove the affected feature until a fix is available.
What to do
- Update cleanstart loki to version 3.7.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | loki |
< 3.7.1-r1 Fix: upgrade to 3.7.1-r1
|
Original advisory text
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh
Security vulnerability affects the loki package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-WU91498 · OSV
Track software like this
Free during beta