Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Minio, Cortex, Thanos, Metrics‑Server may allow data tampering

published 5 days ago
Summary

Versions of Minio, Cortex, Thanos and Metrics‑Server listed are vulnerable to a flaw that could let an attacker alter or corrupt stored data. The problem has been fixed in newer releases of each product. Update to the latest version of each component as soon as possible to protect your data.

What to do
  • Update cleanstart minio to version 0.20250907.161309-r3.
  • Update cleanstart minio to version 0.20250907.161309-r5.
  • Update cleanstart cortex to version 1.21.1-r2.
  • Update cleanstart cortex to version 1.21.1-r3.
  • Update cleanstart thanos to version 0.41.0-r0.
  • Update cleanstart metrics-server to version 0.8.1-r2.
  • Update cleanstart metrics-server to version 0.8.1-r3.
  • Update cleanstart metrics-server to version 0.8.1-r4.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart minio < 0.20250907.161309-r3
< 0.20250907.161309-r5
Fix: upgrade to 0.20250907.161309-r3
CleanStart cleanstart cortex < 1.21.1-r2
< 1.21.1-r3
Fix: upgrade to 1.21.1-r2
CleanStart cleanstart thanos < 0.41.0-r0
Fix: upgrade to 0.41.0-r0
CleanStart cleanstart metrics-server < 0.8.1-r2
< 0.8.1-r3
< 0.8.1-r4
Fix: upgrade to 0.8.1-r2
Original advisory text
Security fix for GHSA-8rm2-7qqf-34qm applied in: minio 0.20250907.161309-r3, minio 0.20250907.161309-r5, cortex 1.21.1-r2, cortex 1.21.1-r3, thanos 0.41.0-r0, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, metrics-server 0.8.1-r4
GHSA-8rm2-7qqf-34qm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-CJ69662 · OSV
Track software like this
Free during beta