Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
cleanstart external-dns-fips and prometheus-node-exporter-fips can expose client identity
published 5 days ago
Summary
Both cleanstart external-dns-fips and prometheus-node-exporter-fips may reveal the names of pre‑shared keys in the clear during an encrypted handshake, allowing someone who is only listening on the network to link the traffic to a specific client. This reduces the privacy that encrypted connections are supposed to provide. Apply the vendor's latest update or disable the feature that uses encrypted client hello until a fix is available.
What to do
- Update cleanstart external-dns-fips to version 0.22.0-r4.
- Update cleanstart prometheus-node-exporter-fips to version 1.11.1-r7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | external-dns-fips |
< 0.22.0-r4 Fix: upgrade to 0.22.0-r4
|
| CleanStart | cleanstart | prometheus-node-exporter-fips |
< 1.11.1-r7 Fix: upgrade to 1.11.1-r7
|
Original advisory text
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello
CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-MS42358 · OSV
Track software like this
Free during beta