Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

cleanstart components can be tricked into running unwanted code

published 1 month ago
Summary

Several cleanstart packages—including Argo Workflows, Cert Manager webhook, Cosign, Flux notification, and Harbor—contain a flaw that could let an attacker make them execute code they shouldn’t. This could lead to unauthorized actions on your systems or data exposure. Updating each package to the latest version fixes the problem, so apply the recommended upgrades as soon as possible.

What to do
  • Update cleanstart argo-workflows-fips to version 3.7.0-r0.
  • Update cleanstart cert-manager-webhook-pdns-fips to version 2.2.0-r0.
  • Update cleanstart cert-manager-webhook-pdns-fips to version 3.0.0-r0.
  • Update cleanstart cert-manager-webhook-pdns-fips to version 3.1.3-r0.
  • Update cleanstart cert-manager-webhook-pdns-fips to version 3.2.3-r0.
  • Update cleanstart cosign to version 2.4.3-r0.
  • Update cleanstart cosign to version 2.5.3-r0.
  • Update cleanstart flux-notification-controller-fips to version 1.5.0-r0.
  • Update cleanstart harbor-fips to version 2.10.3-r0.
  • Update cleanstart harbor-fips to version 2.11.2-r3.
  • Update cleanstart harbor-fips to version 2.12.4-r1.
  • Update cleanstart harbor-fips to version 2.13.2-r1.
  • Update cleanstart harbor-registry to version 3.0.0.1-r2.
  • Update cleanstart ingress-nginx-controller to version 1.24.2-r0.
  • Update cleanstart k8ssandra-operator-fips to version 1.24.0-r0.
  • Update cleanstart k8ssandra-operator-fips to version 3.3.0-r3.
  • Update cleanstart kubernetes-csi-node-driver-registrar to version 2.13.0-r0.
  • Update cleanstart kyverno-policy-reporter-fips to version 3.1.3-r6.
  • Update cleanstart kyverno-policy-reporter-fips to version 3.2.2.
  • Update cleanstart kyverno-policy-reporter-fips to version 3.3.2.
  • Update cleanstart kyverno-policy-reporter-fips to version 3.3.2-r0.
  • Update cleanstart metrics-server to version 0.8.0-r0.
  • Update cleanstart metrics-server-fips to version 0.8.0-r3.
  • Update cleanstart minio-client-fips to version 0.20250416181326-r2.
  • Update cleanstart minio-client-fips to version 0.20250521015954-r2.
  • Update cleanstart minio-client-fips to version 0.20250716.153503-r2.
  • Update cleanstart minio-client-fips to version 0.20250721052808-r2.
  • Update cleanstart nvidia-container-toolkit to version 1.19.0-r0.
  • Update cleanstart opensearch-k8s-operator-fips to version 2.5.1-r0.
  • Update cleanstart opensearch-k8s-operator-fips to version 2.6.1-r0.
  • Update cleanstart opensearch-k8s-operator-fips to version 2.6.1-r7.
  • Update cleanstart opensearch-k8s-operator-fips to version 2.7.0-r7.
  • Update cleanstart prometheus-node-exporter to version 1.8.0-r3.
  • Update cleanstart runc to version 1.1.14-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart argo-workflows-fips < 3.7.0-r0
Fix: upgrade to 3.7.0-r0
CleanStart cleanstart cert-manager-webhook-pdns-fips < 2.2.0-r0
< 3.0.0-r0
< 3.1.3-r0
< 3.2.3-r0
Fix: upgrade to 2.2.0-r0
CleanStart cleanstart cosign < 2.4.3-r0
< 2.5.3-r0
Fix: upgrade to 2.4.3-r0
CleanStart cleanstart flux-notification-controller-fips < 1.5.0-r0
Fix: upgrade to 1.5.0-r0
CleanStart cleanstart harbor-fips < 2.10.3-r0
< 2.11.2-r3
< 2.12.4-r1
< 2.13.2-r1
Fix: upgrade to 2.10.3-r0
CleanStart cleanstart harbor-registry < 3.0.0.1-r2
Fix: upgrade to 3.0.0.1-r2
CleanStart cleanstart ingress-nginx-controller < 1.24.2-r0
Fix: upgrade to 1.24.2-r0
CleanStart cleanstart k8ssandra-operator-fips < 1.24.0-r0
< 3.3.0-r3
Fix: upgrade to 1.24.0-r0
CleanStart cleanstart kubernetes-csi-node-driver-registrar < 2.13.0-r0
Fix: upgrade to 2.13.0-r0
CleanStart cleanstart kyverno-policy-reporter-fips < 3.1.3-r6
< 3.2.2
< 3.3.2
< 3.3.2-r0
Fix: upgrade to 3.1.3-r6
CleanStart cleanstart metrics-server < 0.8.0-r0
Fix: upgrade to 0.8.0-r0
CleanStart cleanstart metrics-server-fips < 0.8.0-r3
Fix: upgrade to 0.8.0-r3
CleanStart cleanstart minio-client-fips < 0.20250416181326-r2
< 0.20250521015954-r2
< 0.20250716.153503-r2
< 0.20250721052808-r2
Fix: upgrade to 0.20250416181326-r2
CleanStart cleanstart nvidia-container-toolkit < 1.19.0-r0
Fix: upgrade to 1.19.0-r0
CleanStart cleanstart opensearch-k8s-operator-fips < 2.5.1-r0
< 2.6.1-r0
< 2.6.1-r7
< 2.7.0-r7
Fix: upgrade to 2.5.1-r0
CleanStart cleanstart prometheus-node-exporter < 1.8.0-r3
Fix: upgrade to 1.8.0-r3
CleanStart cleanstart runc < 1.1.14-r0
Fix: upgrade to 1.1.14-r0
Original advisory text
Security fix for CVE-2025-4673 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, harbor-fips 2.10.3-r0, harbor-fips 2.11.2-r3, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, ingress-nginx-controller 1.24.2-r0, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0
CVE-2025-4673 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-ZG63410 · OSV
Track software like this
Free during beta