Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Cleanstart step-ca and related packages could expose data

published 5 days ago
Summary

The step-ca, litestream, melange, postgres-operator, and crossplane-provider-sql-fips packages from Cleanstart contain a weakness that could let attackers view or modify information they should not access. The problem has been corrected in newer versions of each package. Update to the latest releases as soon as possible to protect your systems.

What to do
  • Update cleanstart step-ca to version 0.30.2-r1.
  • Update cleanstart litestream to version 0.3.14-r2.
  • Update cleanstart litestream to version 0.3.14-r3.
  • Update cleanstart melange to version 0.55.0-r1.
  • Update cleanstart litestream to version 0.5.14-r1.
  • Update cleanstart postgres-operator to version 1.12.2-r1.
  • Update cleanstart crossplane-provider-sql-fips to version 0.15.0-r2.
  • Update cleanstart kumactl to version 2.13.8-r1.
  • Update cleanstart promxy to version 0.0.96-r2.
  • Update cleanstart cadvisor-fips to version 0.60.3-r1.
  • Update cleanstart consul-k8s-fips to version 1.8.14-r1.
  • Update cleanstart argo-events to version 1.6.3-r1.
  • Update cleanstart postgres-operator to version 1.13.0-r1.
  • Update cleanstart vault-k8s-fips to version 1.7.5-r1.
  • Update cleanstart cert-manager-webhook-pdns-fips to version 2.5.5-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart step-ca < 0.30.2-r1
Fix: upgrade to 0.30.2-r1
CleanStart cleanstart litestream < 0.3.14-r2
< 0.3.14-r3
< 0.5.14-r1
Fix: upgrade to 0.3.14-r2
CleanStart cleanstart melange < 0.55.0-r1
Fix: upgrade to 0.55.0-r1
CleanStart cleanstart postgres-operator < 1.12.2-r1
< 1.13.0-r1
Fix: upgrade to 1.12.2-r1
CleanStart cleanstart crossplane-provider-sql-fips < 0.15.0-r2
Fix: upgrade to 0.15.0-r2
CleanStart cleanstart kumactl < 2.13.8-r1
Fix: upgrade to 2.13.8-r1
CleanStart cleanstart promxy < 0.0.96-r2
Fix: upgrade to 0.0.96-r2
CleanStart cleanstart cadvisor-fips < 0.60.3-r1
Fix: upgrade to 0.60.3-r1
CleanStart cleanstart consul-k8s-fips < 1.8.14-r1
Fix: upgrade to 1.8.14-r1
CleanStart cleanstart argo-events < 1.6.3-r1
Fix: upgrade to 1.6.3-r1
CleanStart cleanstart vault-k8s-fips < 1.7.5-r1
Fix: upgrade to 1.7.5-r1
CleanStart cleanstart cert-manager-webhook-pdns-fips < 2.5.5-r1
Fix: upgrade to 2.5.5-r1
Original advisory text
Security fix for GHSA-f5wc-c3c7-36mc applied in: step-ca 0.30.2-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, melange 0.55.0-r1, litestream 0.5.14-r1, postgres-operator 1.12.2-r1, crossplane-provider-sql-fips 0.15.0-r2, kumactl 2.13.8-r1, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1
GHSA-f5wc-c3c7-36mc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-UX66393 · OSV
Track software like this
Free during beta