Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Cleanstart components could be exploited, update applied

published 1 month ago
Summary

The cleanstart packages Cortex, Cosign, Gitea, Karma, and Policy‑Controller‑FIPS have been found to contain a security weakness that could let an attacker perform unauthorized actions. Updating each component to the versions listed in the release notes removes the risk. Apply the latest releases as soon as possible to keep your systems safe.

What to do
  • Update cleanstart cortex to version 1.20.1-r3.
  • Update cleanstart cosign to version 2.6.5-r1.
  • Update cleanstart gitea to version 1.26.4-r1.
  • Update cleanstart gitea to version 1.27.0-r2.
  • Update cleanstart karma to version 0.128-r1.
  • Update cleanstart karma to version 0.129-r1.
  • Update cleanstart karma to version 0.130-r1.
  • Update cleanstart karma to version 0.131-r1.
  • Update cleanstart policy-controller-fips to version 0.15.1-r1.
  • Update cleanstart rclone to version 1.71.2-r3.
  • Update cleanstart rclone to version 1.72.1-r11.
  • Update cleanstart rclone to version 1.73.5-r5.
  • Update cleanstart rclone to version 1.74.3-r2.
  • Update cleanstart spire-server to version 1.14.7-r0.
  • Update cleanstart step to version 0.28.7-r4.
  • Update cleanstart step to version 0.29.0-r3.
  • Update cleanstart step-ca to version 0.27.5-r0.
  • Update cleanstart step-cli to version 0.27.5-r1.
  • Update cleanstart step-cli to version 0.30.6-r0.
  • Update cleanstart step-issuer to version 0.11.0-r4.
  • Update cleanstart step-issuer to version 0.9.11-r2.
  • Update cleanstart tekton-chains to version 0.25.2-r1.
  • Update cleanstart tekton-chains to version 0.26.5-r1.
  • Update cleanstart tekton-chains-fips to version 0.24.0-r1.
  • Update cleanstart tekton-chains-fips to version 0.25.2-r1.
  • Update cleanstart tekton-chains-fips to version 0.26.5-r1.
  • Update cleanstart tkn to version 0.42.2-r1.
  • Update cleanstart tkn to version 0.43.2-r1.
  • Update cleanstart tkn to version 0.44.2-r1.
  • Update cleanstart tkn to version 0.45.0-r1.
  • Update cortex to version 1.20.1-r3.
  • Update cosign to version 2.6.5-r1.
  • Update gitea to version 1.26.4-r1.
  • Update gitea to version 1.27.0-r2.
  • Update karma to version 0.128-r1.
  • Update karma to version 0.129-r1.
  • Update karma to version 0.130-r1.
  • Update karma to version 0.131-r1.
  • Update policy-controller-fips to version 0.15.1-r1.
  • Update rclone to version 1.71.2-r3.
  • Update rclone to version 1.72.1-r11.
  • Update rclone to version 1.73.5-r5.
  • Update rclone to version 1.74.3-r2.
  • Update spire-server to version 1.14.7-r0.
  • Update step to version 0.28.7-r4.
  • Update step to version 0.29.0-r3.
  • Update step-ca to version 0.27.5-r0.
  • Update step-cli to version 0.27.5-r1.
  • Update step-cli to version 0.30.6-r0.
  • Update step-issuer to version 0.11.0-r4.
  • Update step-issuer to version 0.9.11-r2.
  • Update tekton-chains to version 0.25.2-r1.
  • Update tekton-chains to version 0.26.5-r1.
  • Update tekton-chains-fips to version 0.24.0-r1.
  • Update tekton-chains-fips to version 0.25.2-r1.
  • Update tekton-chains-fips to version 0.26.5-r1.
  • Update tkn to version 0.42.2-r1.
  • Update tkn to version 0.43.2-r1.
  • Update tkn to version 0.44.2-r1.
  • Update tkn to version 0.45.0-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart cortex < 1.20.1-r3
Fix: upgrade to 1.20.1-r3
CleanStart cleanstart cosign < 2.6.5-r1
Fix: upgrade to 2.6.5-r1
CleanStart cleanstart gitea < 1.26.4-r1
< 1.27.0-r2
Fix: upgrade to 1.26.4-r1
CleanStart cleanstart karma < 0.128-r1
< 0.129-r1
< 0.130-r1
< 0.131-r1
Fix: upgrade to 0.128-r1
CleanStart cleanstart policy-controller-fips < 0.15.1-r1
Fix: upgrade to 0.15.1-r1
CleanStart cleanstart rclone < 1.71.2-r3
< 1.72.1-r11
< 1.73.5-r5
< 1.74.3-r2
Fix: upgrade to 1.71.2-r3
CleanStart cleanstart spire-server < 1.14.7-r0
Fix: upgrade to 1.14.7-r0
CleanStart cleanstart step < 0.28.7-r4
< 0.29.0-r3
Fix: upgrade to 0.28.7-r4
CleanStart cleanstart step-ca < 0.27.5-r0
Fix: upgrade to 0.27.5-r0
CleanStart cleanstart step-cli < 0.27.5-r1
< 0.30.6-r0
Fix: upgrade to 0.27.5-r1
CleanStart cleanstart step-issuer < 0.11.0-r4
< 0.9.11-r2
Fix: upgrade to 0.11.0-r4
CleanStart cleanstart tekton-chains < 0.25.2-r1
< 0.26.5-r1
Fix: upgrade to 0.25.2-r1
CleanStart cleanstart tekton-chains-fips < 0.24.0-r1
< 0.25.2-r1
< 0.26.5-r1
Fix: upgrade to 0.24.0-r1
CleanStart cleanstart tkn < 0.42.2-r1
< 0.43.2-r1
< 0.44.2-r1
< 0.45.0-r1
Fix: upgrade to 0.42.2-r1
CleanStart – cortex < 1.20.1-r3
Fix: upgrade to 1.20.1-r3
CleanStart – cosign < 2.6.5-r1
Fix: upgrade to 2.6.5-r1
CleanStart – gitea < 1.26.4-r1
< 1.27.0-r2
Fix: upgrade to 1.26.4-r1
CleanStart – karma < 0.128-r1
< 0.129-r1
< 0.130-r1
< 0.131-r1
Fix: upgrade to 0.128-r1
CleanStart – policy-controller-fips < 0.15.1-r1
Fix: upgrade to 0.15.1-r1
CleanStart – rclone < 1.71.2-r3
< 1.72.1-r11
< 1.73.5-r5
< 1.74.3-r2
Fix: upgrade to 1.71.2-r3
CleanStart – spire-server < 1.14.7-r0
Fix: upgrade to 1.14.7-r0
CleanStart – step < 0.28.7-r4
< 0.29.0-r3
Fix: upgrade to 0.28.7-r4
CleanStart – step-ca < 0.27.5-r0
Fix: upgrade to 0.27.5-r0
CleanStart – step-cli < 0.27.5-r1
< 0.30.6-r0
Fix: upgrade to 0.27.5-r1
CleanStart – step-issuer < 0.11.0-r4
< 0.9.11-r2
Fix: upgrade to 0.11.0-r4
CleanStart – tekton-chains < 0.25.2-r1
< 0.26.5-r1
Fix: upgrade to 0.25.2-r1
CleanStart – tekton-chains-fips < 0.24.0-r1
< 0.25.2-r1
< 0.26.5-r1
Fix: upgrade to 0.24.0-r1
CleanStart – tkn < 0.42.2-r1
< 0.43.2-r1
< 0.44.2-r1
< 0.45.0-r1
Fix: upgrade to 0.42.2-r1
Original advisory text
Security fix for GHSA-rjr7-jggh-pgcp applied in: cortex 1.20.1-r3, cosign 2.6.5-r1, gitea 1.26.4-r1, gitea 1.27.0-r2, karma 0.128-r1, karma 0.129-r1, karma 0.130-r1, karma 0.131-r1, policy-controller-fips 0.15.1-r1, rclone 1.71.2-r3, rclone 1.72.1-r11, rclone 1.73.5-r5, rclone 1.74.3-r2, spire-server 1.14.7-r0, step 0.28.7-r4, step 0.29.0-r3, step-ca 0.27.5-r0, step-cli 0.27.5-r1, step-cli 0.30.6-r0, step-issuer 0.11.0-r4, step-issuer 0.9.11-r2, tekton-chains 0.25.2-r1, tekton-chains 0.26.5-r1, tekton-chains-fips 0.24.0-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1
GHSA-rjr7-jggh-pgcp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Severity
8.3 High
Timeline
Published18 Sep 2026
Updated15 Oct 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-LL29921 · OSV
Track software like this
Free during beta