Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Cosign, Kubescape, Kyverno‑FIPS, Sigstore‑Scaffolding, Spire‑Server risk code execution
published 1 month ago
Summary
Several of the listed tools contained a flaw that could let an attacker run unauthorized code. The problem has been fixed in the latest releases of each product. Update to the newest version as soon as possible to stay protected.
What to do
- Update cleanstart cosign to version 2.4.3-r0.
- Update cleanstart cosign to version 2.5.3-r0.
- Update cleanstart kubescape to version 3.0.47-r0.
- Update cleanstart kyverno-fips to version 1.16.1-r2.
- Update cleanstart sigstore-scaffolding to version 0.7.31-r0.
- Update cleanstart spire-server to version 1.14.1-r1.
- Update cleanstart spire-server-fips to version 1.14.1-r1.
- Update cleanstart tekton-chains to version 0.26.0-r1.
- Update cleanstart tekton-chains-fips to version 0.26.0-r1.
- Update cleanstart tkn-fips to version 0.43.0-r2.
- Update cosign to version 2.4.3-r0.
- Update cosign to version 2.5.3-r0.
- Update kubescape to version 3.0.47-r0.
- Update kyverno-fips to version 1.16.1-r2.
- Update sigstore-scaffolding to version 0.7.31-r0.
- Update spire-server to version 1.14.1-r1.
- Update spire-server-fips to version 1.14.1-r1.
- Update tekton-chains to version 0.26.0-r1.
- Update tekton-chains-fips to version 0.26.0-r1.
- Update tkn-fips to version 0.43.0-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | cosign |
< 2.4.3-r0 < 2.5.3-r0 Fix: upgrade to 2.4.3-r0
|
| CleanStart | cleanstart | kubescape |
< 3.0.47-r0 Fix: upgrade to 3.0.47-r0
|
| CleanStart | cleanstart | kyverno-fips |
< 1.16.1-r2 Fix: upgrade to 1.16.1-r2
|
| CleanStart | cleanstart | sigstore-scaffolding |
< 0.7.31-r0 Fix: upgrade to 0.7.31-r0
|
| CleanStart | cleanstart | spire-server |
< 1.14.1-r1 Fix: upgrade to 1.14.1-r1
|
| CleanStart | cleanstart | spire-server-fips |
< 1.14.1-r1 Fix: upgrade to 1.14.1-r1
|
| CleanStart | cleanstart | tekton-chains |
< 0.26.0-r1 Fix: upgrade to 0.26.0-r1
|
| CleanStart | cleanstart | tekton-chains-fips |
< 0.26.0-r1 Fix: upgrade to 0.26.0-r1
|
| CleanStart | cleanstart | tkn-fips |
< 0.43.0-r2 Fix: upgrade to 0.43.0-r2
|
| CleanStart | – | cosign |
< 2.4.3-r0 < 2.5.3-r0 Fix: upgrade to 2.4.3-r0
|
| CleanStart | – | kubescape |
< 3.0.47-r0 Fix: upgrade to 3.0.47-r0
|
| CleanStart | – | kyverno-fips |
< 1.16.1-r2 Fix: upgrade to 1.16.1-r2
|
| CleanStart | – | sigstore-scaffolding |
< 0.7.31-r0 Fix: upgrade to 0.7.31-r0
|
| CleanStart | – | spire-server |
< 1.14.1-r1 Fix: upgrade to 1.14.1-r1
|
| CleanStart | – | spire-server-fips |
< 1.14.1-r1 Fix: upgrade to 1.14.1-r1
|
| CleanStart | – | tekton-chains |
< 0.26.0-r1 Fix: upgrade to 0.26.0-r1
|
| CleanStart | – | tekton-chains-fips |
< 0.26.0-r1 Fix: upgrade to 0.26.0-r1
|
| CleanStart | – | tkn-fips |
< 0.43.0-r2 Fix: upgrade to 0.43.0-r2
|
Original advisory text
Security fix for GHSA-846p-jg2w-w324 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, kubescape 3.0.47-r0, kyverno-fips 1.16.1-r2, sigstore-scaffolding 0.7.31-r0, spire-server 1.14.1-r1, spire-server-fips 1.14.1-r1, tekton-chains 0.26.0-r1, tekton-chains-fips 0.26.0-r1, tkn-fips 0.43.0-r2
GHSA-846p-jg2w-w324 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Severity
5.9
Medium
Timeline
Published18 Sep 2026
Updated15 Oct 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-HN41905 · OSV
Track software like this
Free during beta