Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Various CI/CD and cloud tools risk unauthorized code execution
published 1 month ago
Summary
Several packages including Apache NiFi, Argo CD, Cert‑Manager and related components have a flaw that could let an attacker run code they shouldn’t. The problem is fixed in newer versions, so update each affected product to the latest release as soon as possible.
What to do
- Update cleanstart apache-nifi to version 2.10.0-r4.
- Update cleanstart argo-cd to version 2.14.20-r0.
- Update cleanstart argo-cd-fips to version 2.13.9-r3.
- Update cleanstart argo-cd-fips to version 2.14.20-r0.
- Update cleanstart argo-cd-fips to version 3.1.9-r0.
- Update cleanstart cert-manager-cmctl-fips to version 2.4.0-r1.
- Update cleanstart cert-manager-fips to version 1.18.2-r0.
- Update cleanstart cert-manager-fips to version 1.19.1-r0.
- Update cleanstart cert-manager-webhook-pdns-fips to version 2.2.0-r0.
- Update cleanstart chartmuseum-fips to version 0.15.0-r4.
- Update cleanstart chartmuseum-fips to version 0.16.3-r3.
- Update cleanstart cni-plugin-flannel to version 1.6.0-r0.
- Update cleanstart cosign to version 2.4.3-r0.
- Update cleanstart cosign to version 2.5.3-r0.
- Update cleanstart dex-fips to version 2.41.1-r4.
- Update cleanstart dex-fips to version 2.42.1-r4.
- Update cleanstart dex-fips to version 2.43.1-r4.
- Update cleanstart druid-exporter-fips to version 0.11-r2.
- Update cleanstart eck-operator-fips to version 3.2.0-r0.
- Update cleanstart external-dns-fips to version 0.20.0-r0.
- Update cleanstart flux-notification-controller-fips to version 1.5.0-r0.
- Update cleanstart git-lfs-fips to version 3.7.0-r0.
- Update cleanstart go-discover-fips to version 0_git20250325-r0.
- Update cleanstart go-fips-1.24 to version 1.24.9-r0.
- Update cleanstart go-fips-1.25 to version 1.25.1-r0.
- Update cleanstart harbor-registry to version 3.0.0.1-r2.
- Update cleanstart harbor-registry-fips to version 3.0.0-r1.
- Update cleanstart helm to version 3.19.0-r0.
- Update cleanstart helm-fips to version 3.19.0-r0.
- Update cleanstart helm-operator to version 1.41.1-r0.
- Update cleanstart k8ssandra-client-fips to version 0.7.0-r2.
- Update cleanstart k8ssandra-client-fips to version 0.7.0-r4.
- Update cleanstart k8ssandra-operator to version 1.26.0-r0.
- Update cleanstart kube-rbac-proxy-fips to version 0.19.1-r1.
- Update cleanstart kube-state-metrics to version 2.16.0-r3.
- Update cleanstart kubernetes to version 1.34.1-r0.
- Update cleanstart kubernetes-csi-node-driver-registrar to version 2.13.0-r0.
- Update cleanstart kured to version 1.20.0-r0.
- Update cleanstart kustomize-fips to version 5.7.1-r0.
- Update cleanstart kyverno to version 1.15.2-r0.
- Update cleanstart logstash-exporter to version 1.9.1-r0.
- Update cleanstart metallb to version 0.14.9-r0.
- Update cleanstart metallb to version 0.15.2-r0.
- Update cleanstart minio-operator to version 7.1.1-r0.
- Update cleanstart modelmesh-runtime-adapter to version 0.12.0-r0.
- Update cleanstart modelmesh-runtime-adapter to version 0.12.0-r1.
- Update cleanstart nvidia-container-toolkit to version 1.19.0-r0.
- Update cleanstart opensearch-k8s-operator-fips to version 2.5.1-r1.
- Update cleanstart opensearch-k8s-operator-fips to version 2.6.1-r7.
- Update cleanstart opensearch-k8s-operator-fips to version 2.7.0-r8.
- Update cleanstart prometheus-node-exporter to version 1.8.0-r3.
- Update cleanstart runc to version 1.1.14-r0.
- Update cleanstart spark-operator to version 2.2.1-r0.
- Update cleanstart stakater-reloader to version 1.4.8-r0.
- Update cleanstart step to version 0.28.7-r1.
- Update cleanstart step-cli to version 0.28.7-r1.
- Update cleanstart step-issuer to version 0.9.9-r1.
- Update cleanstart step-issuer-fips to version 0.9.11-r1.
- Update cleanstart step-issuer-fips to version 0.9.9-r1.
- Update cleanstart vault-k8s to version 1.7.0-r0.
- Update cleanstart velero to version 1.17.0-r0.
- Update cleanstart velero-plugin-for-aws to version 1.13.0-r0.
- Update cleanstart velero-plugin-for-csi to version 0.7.1-r0.
- Update cleanstart wave to version 0.10.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-nifi |
< 2.10.0-r4 Fix: upgrade to 2.10.0-r4
|
| CleanStart | cleanstart | argo-cd |
< 2.14.20-r0 Fix: upgrade to 2.14.20-r0
|
| CleanStart | cleanstart | argo-cd-fips |
< 2.13.9-r3 < 2.14.20-r0 < 3.1.9-r0 Fix: upgrade to 2.13.9-r3
|
| CleanStart | cleanstart | cert-manager-cmctl-fips |
< 2.4.0-r1 Fix: upgrade to 2.4.0-r1
|
| CleanStart | cleanstart | cert-manager-fips |
< 1.18.2-r0 < 1.19.1-r0 Fix: upgrade to 1.18.2-r0
|
| CleanStart | cleanstart | cert-manager-webhook-pdns-fips |
< 2.2.0-r0 Fix: upgrade to 2.2.0-r0
|
| CleanStart | cleanstart | chartmuseum-fips |
< 0.15.0-r4 < 0.16.3-r3 Fix: upgrade to 0.15.0-r4
|
| CleanStart | cleanstart | cni-plugin-flannel |
< 1.6.0-r0 Fix: upgrade to 1.6.0-r0
|
| CleanStart | cleanstart | cosign |
< 2.4.3-r0 < 2.5.3-r0 Fix: upgrade to 2.4.3-r0
|
| CleanStart | cleanstart | dex-fips |
< 2.41.1-r4 < 2.42.1-r4 < 2.43.1-r4 Fix: upgrade to 2.41.1-r4
|
| CleanStart | cleanstart | druid-exporter-fips |
< 0.11-r2 Fix: upgrade to 0.11-r2
|
| CleanStart | cleanstart | eck-operator-fips |
< 3.2.0-r0 Fix: upgrade to 3.2.0-r0
|
| CleanStart | cleanstart | external-dns-fips |
< 0.20.0-r0 Fix: upgrade to 0.20.0-r0
|
| CleanStart | cleanstart | flux-notification-controller-fips |
< 1.5.0-r0 Fix: upgrade to 1.5.0-r0
|
| CleanStart | cleanstart | git-lfs-fips |
< 3.7.0-r0 Fix: upgrade to 3.7.0-r0
|
| CleanStart | cleanstart | go-discover-fips |
< 0_git20250325-r0 Fix: upgrade to 0_git20250325-r0
|
| CleanStart | cleanstart | go-fips-1.24 |
< 1.24.9-r0 Fix: upgrade to 1.24.9-r0
|
| CleanStart | cleanstart | go-fips-1.25 |
< 1.25.1-r0 Fix: upgrade to 1.25.1-r0
|
| CleanStart | cleanstart | harbor-registry |
< 3.0.0.1-r2 Fix: upgrade to 3.0.0.1-r2
|
| CleanStart | cleanstart | harbor-registry-fips |
< 3.0.0-r1 Fix: upgrade to 3.0.0-r1
|
| CleanStart | cleanstart | helm |
< 3.19.0-r0 Fix: upgrade to 3.19.0-r0
|
| CleanStart | cleanstart | helm-fips |
< 3.19.0-r0 Fix: upgrade to 3.19.0-r0
|
| CleanStart | cleanstart | helm-operator |
< 1.41.1-r0 Fix: upgrade to 1.41.1-r0
|
| CleanStart | cleanstart | k8ssandra-client-fips |
< 0.7.0-r2 < 0.7.0-r4 Fix: upgrade to 0.7.0-r2
|
| CleanStart | cleanstart | k8ssandra-operator |
< 1.26.0-r0 Fix: upgrade to 1.26.0-r0
|
| CleanStart | cleanstart | kube-rbac-proxy-fips |
< 0.19.1-r1 Fix: upgrade to 0.19.1-r1
|
| CleanStart | cleanstart | kube-state-metrics |
< 2.16.0-r3 Fix: upgrade to 2.16.0-r3
|
| CleanStart | cleanstart | kubernetes |
< 1.34.1-r0 Fix: upgrade to 1.34.1-r0
|
| CleanStart | cleanstart | kubernetes-csi-node-driver-registrar |
< 2.13.0-r0 Fix: upgrade to 2.13.0-r0
|
| CleanStart | cleanstart | kured |
< 1.20.0-r0 Fix: upgrade to 1.20.0-r0
|
| CleanStart | cleanstart | kustomize-fips |
< 5.7.1-r0 Fix: upgrade to 5.7.1-r0
|
| CleanStart | cleanstart | kyverno |
< 1.15.2-r0 Fix: upgrade to 1.15.2-r0
|
| CleanStart | cleanstart | logstash-exporter |
< 1.9.1-r0 Fix: upgrade to 1.9.1-r0
|
| CleanStart | cleanstart | metallb |
< 0.14.9-r0 < 0.15.2-r0 Fix: upgrade to 0.14.9-r0
|
| CleanStart | cleanstart | minio-operator |
< 7.1.1-r0 Fix: upgrade to 7.1.1-r0
|
| CleanStart | cleanstart | modelmesh-runtime-adapter |
< 0.12.0-r0 < 0.12.0-r1 Fix: upgrade to 0.12.0-r0
|
| CleanStart | cleanstart | nvidia-container-toolkit |
< 1.19.0-r0 Fix: upgrade to 1.19.0-r0
|
| CleanStart | cleanstart | opensearch-k8s-operator-fips |
< 2.5.1-r1 < 2.6.1-r7 < 2.7.0-r8 Fix: upgrade to 2.5.1-r1
|
| CleanStart | cleanstart | prometheus-node-exporter |
< 1.8.0-r3 Fix: upgrade to 1.8.0-r3
|
| CleanStart | cleanstart | runc |
< 1.1.14-r0 Fix: upgrade to 1.1.14-r0
|
| CleanStart | cleanstart | spark-operator |
< 2.2.1-r0 Fix: upgrade to 2.2.1-r0
|
| CleanStart | cleanstart | stakater-reloader |
< 1.4.8-r0 Fix: upgrade to 1.4.8-r0
|
| CleanStart | cleanstart | step |
< 0.28.7-r1 Fix: upgrade to 0.28.7-r1
|
| CleanStart | cleanstart | step-cli |
< 0.28.7-r1 Fix: upgrade to 0.28.7-r1
|
| CleanStart | cleanstart | step-issuer |
< 0.9.9-r1 Fix: upgrade to 0.9.9-r1
|
| CleanStart | cleanstart | step-issuer-fips |
< 0.9.11-r1 < 0.9.9-r1 Fix: upgrade to 0.9.11-r1
|
| CleanStart | cleanstart | vault-k8s |
< 1.7.0-r0 Fix: upgrade to 1.7.0-r0
|
| CleanStart | cleanstart | velero |
< 1.17.0-r0 Fix: upgrade to 1.17.0-r0
|
| CleanStart | cleanstart | velero-plugin-for-aws |
< 1.13.0-r0 Fix: upgrade to 1.13.0-r0
|
| CleanStart | cleanstart | velero-plugin-for-csi |
< 0.7.1-r0 Fix: upgrade to 0.7.1-r0
|
Showing 50 of 51. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | wave |
< 0.10.0-r0 Fix: upgrade to 0.10.0-r0
|
Original advisory text
Security fix for CVE-2025-58188 applied in: apache-nifi 2.10.0-r4, argo-cd 2.14.20-r0, argo-cd-fips 2.13.9-r3, argo-cd-fips 2.14.20-r0, argo-cd-fips 3.1.9-r0, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cni-plugin-flannel 1.6.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, druid-exporter-fips 0.11-r2, eck-operator-fips 3.2.0-r0, external-dns-fips 0.20.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.24 1.24.9-r0, go-fips-1.25 1.25.1-r0, harbor-registry 3.0.0.1-r2, harbor-registry-fips 3.0.0-r1, helm 3.19.0-r0, helm-fips 3.19.0-r0, helm-operator 1.41.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kubernetes 1.34.1-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kured 1.20.0-r0, kustomize-fips 5.7.1-r0, kyverno 1.15.2-r0, logstash-exporter 1.9.1-r0, metallb 0.14.9-r0, metallb 0.15.2-r0, minio-operator 7.1.1-r0, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0, stakater-reloader 1.4.8-r0, step 0.28.7-r1, step-cli 0.28.7-r1, step-issuer 0.9.9-r1, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r1, vault-k8s 1.7.0-r0, velero 1.17.0-r0, velero-plugin-for-aws 1.13.0-r0, velero-plugin-for-csi 0.7.1-r0, wave 0.10.0-r0
CVE-2025-58188 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-IV08874 · OSV
Track software like this
Free during beta