Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
Kube-state-metrics, CSI Snapshotter, RabbitMQ Operator, Minio, Velero allow privilege escalation
published 5 days ago
Summary
Several open‑source components used on Linux—kube-state-metrics, the Kubernetes CSI external snapshotter, the RabbitMQ Cluster Operator, Minio, and Velero—contain a flaw that could let an attacker gain higher system privileges. This could let malicious code run with more rights than intended, potentially affecting the whole cluster. Apply the latest patches or upgrade to the newest versions of these packages as soon as possible.
What to do
- Update cleanstart kube-state-metrics to version 2.18.0-r1.
- Update cleanstart kubernetes-csi-external-snapshotter to version 8.6.0-r2.
- Update cleanstart kubernetes-csi-external-snapshotter to version 8.6.0-r3.
- Update cleanstart kubernetes-csi-external-snapshotter to version 8.6.0-r4.
- Update cleanstart rabbitmq-cluster-operator to version 2.19.2-r0.
- Update cleanstart minio to version 0.20250907.161309-r3.
- Update cleanstart velero to version 1.16.2-r0.
- Update cleanstart prometheus-mysqld-exporter to version 0.18.0-r2.
- Update cleanstart rabbitmq-messaging-topology-operator to version 1.18.3-r0.
- Update cleanstart argo-cd-fips to version 3.3.7-r3.
- Update cleanstart temporal-server-fips to version 1.31.1-r1.
- Update cleanstart vt-cli to version 1.2.0-r0.
- Update cleanstart opentofu-fips to version 1.11.5-r3.
- Update cleanstart consul to version 1.21.5-r1.
- Update cleanstart thanos to version 0.41.0-r0.
- Update cleanstart velero-plugin-for-aws to version 1.11.1-r3.
- Update cleanstart calico to version 3.31.4-r1.
- Update cleanstart logstash-exporter-fips to version 1.6.4-r0.
- Update cleanstart logstash-exporter-fips to version 1.7.1-r0.
- Update cleanstart logstash-exporter-fips to version 1.8.4-r1.
- Update cleanstart logstash-exporter-fips to version 1.9.1-r1.
- Update cleanstart prometheus to version 3.10.0-r1.
- Update cleanstart sealed-secrets to version 0.35.0-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | kube-state-metrics |
< 2.18.0-r1 Fix: upgrade to 2.18.0-r1
|
| CleanStart | cleanstart | kubernetes-csi-external-snapshotter |
< 8.6.0-r2 < 8.6.0-r3 < 8.6.0-r4 Fix: upgrade to 8.6.0-r2
|
| CleanStart | cleanstart | rabbitmq-cluster-operator |
< 2.19.2-r0 Fix: upgrade to 2.19.2-r0
|
| CleanStart | cleanstart | minio |
< 0.20250907.161309-r3 Fix: upgrade to 0.20250907.161309-r3
|
| CleanStart | cleanstart | velero |
< 1.16.2-r0 Fix: upgrade to 1.16.2-r0
|
| CleanStart | cleanstart | prometheus-mysqld-exporter |
< 0.18.0-r2 Fix: upgrade to 0.18.0-r2
|
| CleanStart | cleanstart | rabbitmq-messaging-topology-operator |
< 1.18.3-r0 Fix: upgrade to 1.18.3-r0
|
| CleanStart | cleanstart | argo-cd-fips |
< 3.3.7-r3 Fix: upgrade to 3.3.7-r3
|
| CleanStart | cleanstart | temporal-server-fips |
< 1.31.1-r1 Fix: upgrade to 1.31.1-r1
|
| CleanStart | cleanstart | vt-cli |
< 1.2.0-r0 Fix: upgrade to 1.2.0-r0
|
| CleanStart | cleanstart | opentofu-fips |
< 1.11.5-r3 Fix: upgrade to 1.11.5-r3
|
| CleanStart | cleanstart | consul |
< 1.21.5-r1 Fix: upgrade to 1.21.5-r1
|
| CleanStart | cleanstart | thanos |
< 0.41.0-r0 Fix: upgrade to 0.41.0-r0
|
| CleanStart | cleanstart | velero-plugin-for-aws |
< 1.11.1-r3 Fix: upgrade to 1.11.1-r3
|
| CleanStart | cleanstart | calico |
< 3.31.4-r1 Fix: upgrade to 3.31.4-r1
|
| CleanStart | cleanstart | logstash-exporter-fips |
< 1.6.4-r0 < 1.7.1-r0 < 1.8.4-r1 < 1.9.1-r1 Fix: upgrade to 1.6.4-r0
|
| CleanStart | cleanstart | prometheus |
< 3.10.0-r1 Fix: upgrade to 3.10.0-r1
|
| CleanStart | cleanstart | sealed-secrets |
< 0.35.0-r1 Fix: upgrade to 0.35.0-r1
|
Original advisory text
On Linux, if the target of Root
CVE-2026-32282 affects multiple packages. On Linux, if the target of Root. See references for individual vulnerability details.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-LG40780 · OSV
Track software like this
Free during beta