Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
grafana-alloy-fips could let attackers bypass controls
published 5 months ago
Summary
The grafana-alloy-fips component in the cleanstart package contains several coding errors that could let a malicious user gain unauthorized access or affect the system’s behavior. These problems have been fixed in newer versions (1.12.1‑r2, 1.14.2‑r1, 1.14.2‑r2, 1.14.2.r0). Upgrade to one of the listed releases as soon as possible to stay protected.
What to do
- Update cleanstart grafana-alloy-fips to version 1.14.2.r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | grafana-alloy-fips |
< 1.14.2.r0 Fix: upgrade to 1.14.2.r0
|
Original advisory text
Security fixes for CVE-2025-11579, CVE-2026-1229, CVE-2026-21726, CVE-2026-24051, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34040, CVE-2026-34165, CVE-2026-34986, CVE-2026-39882, ghsa-3xc5-wrhm-f963, ghsa-497x-rrr9-68jp, ghsa-6g7g-w4f8-9c9x, ghsa-78h2-9frx-2jm8, ghsa-9h8m-3fm2-qjrq, ghsa-fw7p-63qq-7hpr, ghsa-gm2x-2g9h-ccm8, ghsa-jhf3-xxhw-2wpp, ghsa-jqcq-xjh3-6g23, ghsa-p77j-4mvh-x3m3, ghsa-q9hv-hpm4-hj6x, ghsa-rwvp-r38j-9rgg, ghsa-w8rr-5gcm-pp58, ghsa-x6gf-mpr2-68h6, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.12.1-r2, 1.14.2-r1, 1.14.2-r2, 1.14.2.r0
Multiple security vulnerabilities affect the grafana-alloy-fips package. These issues are resolved in later releases. See references for individual vulnerability details.
References
- https://osv.dev/vulnerability/CVE-2026-25679 URL
- https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advis... Vendor Advisory
- https://osv.dev/vulnerability/CVE-2025-11579 URL
- https://osv.dev/vulnerability/CVE-2026-1229 URL
- https://osv.dev/vulnerability/CVE-2026-21726 URL
- https://osv.dev/vulnerability/CVE-2026-24051 URL
- https://osv.dev/vulnerability/CVE-2026-27139 URL
- https://osv.dev/vulnerability/CVE-2026-27142 URL
- https://osv.dev/vulnerability/CVE-2026-33186 URL
- https://osv.dev/vulnerability/CVE-2026-33762 URL
- https://osv.dev/vulnerability/CVE-2026-34040 URL
- https://osv.dev/vulnerability/CVE-2026-34165 URL
- https://osv.dev/vulnerability/CVE-2026-34986 URL
- https://osv.dev/vulnerability/CVE-2026-39882 URL
- https://osv.dev/vulnerability/ghsa-3xc5-wrhm-f963 URL
- https://osv.dev/vulnerability/ghsa-497x-rrr9-68jp URL
- https://osv.dev/vulnerability/ghsa-6g7g-w4f8-9c9x URL
- https://osv.dev/vulnerability/ghsa-78h2-9frx-2jm8 URL
- https://osv.dev/vulnerability/ghsa-9h8m-3fm2-qjrq URL
- https://osv.dev/vulnerability/ghsa-fw7p-63qq-7hpr URL
- https://osv.dev/vulnerability/ghsa-gm2x-2g9h-ccm8 URL
- https://osv.dev/vulnerability/ghsa-jhf3-xxhw-2wpp URL
- https://osv.dev/vulnerability/ghsa-jqcq-xjh3-6g23 URL
- https://osv.dev/vulnerability/ghsa-p77j-4mvh-x3m3 URL
- https://osv.dev/vulnerability/ghsa-q9hv-hpm4-hj6x URL
- https://osv.dev/vulnerability/ghsa-rwvp-r38j-9rgg URL
- https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58 URL
- https://osv.dev/vulnerability/ghsa-x6gf-mpr2-68h6 URL
- https://osv.dev/vulnerability/ghsa-xmrv-pmrh-hhx2 URL
- https://nvd.nist.gov/vuln/detail/CVE-2025-11579 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-1229 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-21726 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-24051 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-27139 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-27142 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-33762 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-34040 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-34165 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-34986 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-39882 URL
Timeline
Published18 May 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-ET12387 · OSV
Track software like this
Free during beta