Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
Prometheus Redis Exporter and Temporal Server keyring may ignore confirmation
published 1 month ago
Summary
Both the Prometheus Redis Exporter and Temporal Server create an in‑memory key store that can accept keys marked as needing user confirmation, but the software never checks that confirmation before using the keys. This could let unauthorized keys be used without oversight. Upgrade to the latest released versions or apply the vendor’s security patches to ensure the confirmation step is enforced.
What to do
- Update cleanstart prometheus-redis-exporter-fips to version 1.92.1-r0.
- Update cleanstart temporal-server to version 1.31.3-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | prometheus-redis-exporter-fips |
< 1.92.1-r0 Fix: upgrade to 1.92.1-r0
|
| CleanStart | cleanstart | temporal-server |
< 1.31.3-r1 Fix: upgrade to 1.31.3-r1
|
Original advisory text
in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it
CVE-2026-39833 affects multiple packages. The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. See references for individual vulnerability details.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-UZ18323 · OSV
Track software like this
Free during beta