Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

cleanstart/k8sgpt may skip email constraints in certificates

published 5 days ago
Summary

The listed cleanstart tools can incorrectly verify email address restrictions in digital certificates, using only the last rule and ignoring earlier ones. This can allow unauthorized users to appear to have valid email credentials. Update to the latest versions of the affected packages to fix the verification logic.

What to do
  • Update cleanstart k8sgpt to version 0.1.8-r3.
  • Update cleanstart k8sgpt-operator to version 0.2.27-r2.
  • Update cleanstart volume-modifier-for-k8s-fips to version 0.9.5-r2.
  • Update cleanstart volume-modifier-for-k8s to version 0.9.5-r2.
  • Update cleanstart gostatsd to version 28.3.0-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart k8sgpt < 0.1.8-r3
Fix: upgrade to 0.1.8-r3
CleanStart cleanstart k8sgpt-operator < 0.2.27-r2
Fix: upgrade to 0.2.27-r2
CleanStart cleanstart volume-modifier-for-k8s-fips < 0.9.5-r2
Fix: upgrade to 0.9.5-r2
CleanStart cleanstart volume-modifier-for-k8s < 0.9.5-r2
Fix: upgrade to 0.9.5-r2
CleanStart cleanstart gostatsd < 28.3.0-r1
Fix: upgrade to 28.3.0-r1
Original advisory text
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...
CVE-2026-27137 affects multiple packages. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-HF45764 · OSV
Track software like this
Free during beta