Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

kubernetes-csi-external-snapshotter and related packages may allow unauthorized actions

published 5 days ago
Summary

Several components—including kubernetes-csi-external-snapshotter, bank-vaults, yunikorn-k8shim, temporal-server-fips, and ollama-fips—contain a code issue that could let an attacker perform actions they shouldn’t be able to. The problem is fixed in newer releases of each package. Upgrade to the latest available versions to remove the risk.

What to do
  • Update cleanstart kubernetes-csi-external-snapshotter to version 8.6.0-r1.
  • Update cleanstart bank-vaults to version 1.32.1-r1.
  • Update cleanstart yunikorn-k8shim to version 1.8.0-r1.
  • Update cleanstart temporal-server-fips to version 1.31.1-r1.
  • Update cleanstart ollama-fips to version 0.34.4-r2.
  • Update cleanstart flux-image-automation-controller to version 1.2.1-r1.
  • Update cleanstart kumactl to version 2.14.0-r1.
  • Update cleanstart velero-fips to version 1.18.2-r1.
  • Update cleanstart velero-fips to version 1.18.2-r2.
  • Update cleanstart velero-fips to version 1.18.2-r3.
  • Update cleanstart fulcio to version 1.8.7-r2.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart kubernetes-csi-external-snapshotter < 8.6.0-r1
Fix: upgrade to 8.6.0-r1
CleanStart cleanstart bank-vaults < 1.32.1-r1
Fix: upgrade to 1.32.1-r1
CleanStart cleanstart yunikorn-k8shim < 1.8.0-r1
Fix: upgrade to 1.8.0-r1
CleanStart cleanstart temporal-server-fips < 1.31.1-r1
Fix: upgrade to 1.31.1-r1
CleanStart cleanstart ollama-fips < 0.34.4-r2
Fix: upgrade to 0.34.4-r2
CleanStart cleanstart flux-image-automation-controller < 1.2.1-r1
Fix: upgrade to 1.2.1-r1
CleanStart cleanstart kumactl < 2.14.0-r1
Fix: upgrade to 2.14.0-r1
CleanStart cleanstart velero-fips < 1.18.2-r1
< 1.18.2-r2
< 1.18.2-r3
Fix: upgrade to 1.18.2-r1
CleanStart cleanstart fulcio < 1.8.7-r2
Fix: upgrade to 1.8.7-r2
Original advisory text
Security fix for GHSA-w879-237q-wc7r applied in: kubernetes-csi-external-snapshotter 8.6.0-r1, bank-vaults 1.32.1-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2
GHSA-w879-237q-wc7r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-OK40538 · OSV
Track software like this
Free during beta