Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
Kube-state-metrics etc may bypass DNS certificate checks
published 5 days ago
Summary
The listed tools (kube-state-metrics, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, prometheus-mysqld-exporter) can incorrectly validate TLS certificates when a wildcard domain name uses different letter case. This means a malicious server could appear trusted and intercept data. Update to the latest versions of each package or apply vendor patches that fix the certificate verification logic.
What to do
- Update cleanstart kube-state-metrics to version 2.18.0-r1.
- Update cleanstart kubernetes-csi-external-snapshotter to version 8.6.0-r2.
- Update cleanstart kubernetes-csi-external-snapshotter to version 8.6.0-r3.
- Update cleanstart rabbitmq-cluster-operator to version 2.19.2-r0.
- Update cleanstart minio to version 0.20250907.161309-r3.
- Update cleanstart prometheus-mysqld-exporter to version 0.18.0-r2.
- Update cleanstart opentofu-fips to version 1.11.5-r3.
- Update cleanstart consul to version 1.21.5-r1.
- Update cleanstart fabric-peer to version 2.5.15-r0.
- Update cleanstart fabric-peer to version 3.1.4-r0.
- Update cleanstart velero-plugin-for-aws to version 1.11.1-r3.
- Update cleanstart calico to version 3.31.4-r1.
- Update cleanstart prometheus to version 3.10.0-r1.
- Update cleanstart sealed-secrets to version 0.35.0-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | kube-state-metrics |
< 2.18.0-r1 Fix: upgrade to 2.18.0-r1
|
| CleanStart | cleanstart | kubernetes-csi-external-snapshotter |
< 8.6.0-r2 < 8.6.0-r3 Fix: upgrade to 8.6.0-r2
|
| CleanStart | cleanstart | rabbitmq-cluster-operator |
< 2.19.2-r0 Fix: upgrade to 2.19.2-r0
|
| CleanStart | cleanstart | minio |
< 0.20250907.161309-r3 Fix: upgrade to 0.20250907.161309-r3
|
| CleanStart | cleanstart | prometheus-mysqld-exporter |
< 0.18.0-r2 Fix: upgrade to 0.18.0-r2
|
| CleanStart | cleanstart | opentofu-fips |
< 1.11.5-r3 Fix: upgrade to 1.11.5-r3
|
| CleanStart | cleanstart | consul |
< 1.21.5-r1 Fix: upgrade to 1.21.5-r1
|
| CleanStart | cleanstart | fabric-peer |
< 2.5.15-r0 < 3.1.4-r0 Fix: upgrade to 2.5.15-r0
|
| CleanStart | cleanstart | velero-plugin-for-aws |
< 1.11.1-r3 Fix: upgrade to 1.11.1-r3
|
| CleanStart | cleanstart | calico |
< 3.31.4-r1 Fix: upgrade to 3.31.4-r1
|
| CleanStart | cleanstart | prometheus |
< 3.10.0-r1 Fix: upgrade to 3.10.0-r1
|
| CleanStart | cleanstart | sealed-secrets |
< 0.35.0-r1 Fix: upgrade to 0.35.0-r1
|
Original advisory text
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint
CVE-2026-33810 affects multiple packages. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-QP34270 · OSV
Track software like this
Free during beta