Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache NiFi and related components patched to block unauthorized access
published 1 month ago
Summary
Several open‑source tools, including Apache NiFi, the AWS EFS CSI driver, and other listed packages, had a flaw that could let attackers bypass security controls. The problem has been fixed in newer releases, so updating to the latest versions will protect your systems.
What to do
- Update cleanstart apache-nifi to version 2.10.0-r4.
- Update cleanstart aws-efs-csi-driver to version 2.2.0-r0.
- Update cleanstart aws-privateca-issuer to version 1.7.0-r0.
- Update cleanstart aws-privateca-issuer-fips to version 1.7.0-r0.
- Update cleanstart cadvisor to version 0.53.0-r0.
- Update cleanstart cadvisor to version 0.54.1-r0.
- Update cleanstart cfssl to version 1.5.0-r1.
- Update cleanstart cosign to version 2.4.3-r0.
- Update cleanstart cosign to version 2.5.3-r0.
- Update cleanstart eks-distro-kube-apiserver to version 1.34.2-r0.
- Update cleanstart eks-distro-kube-apiserver-fips to version 1.34.2-r0.
- Update cleanstart envoy-ratelimit to version 0.0.0_git20251231-r0.
- Update cleanstart external-dns to version 0.18.0-r0.
- Update cleanstart flux-notification-controller-fips to version 1.5.0-r0.
- Update cleanstart git-lfs-fips to version 3.7.0-r2.
- Update cleanstart hubble-ui to version 0.13.3-r1.
- Update cleanstart hubble-ui-fips to version 0.13.3-r1.
- Update cleanstart ip-masq-agent to version 2.12.6-r1.
- Update cleanstart k8ssandra-operator to version 1.26.0-r0.
- Update cleanstart k8ssandra-operator-fips to version 1.29.0-r1.
- Update cleanstart karpenter-fips to version 1.8.6-r0.
- Update cleanstart kserve-rest-proxy to version 0.12.0-r3.
- Update cleanstart kube-fluentd-operator to version 1.18.2-r0.
- Update cleanstart kube-state-metrics to version 2.10.1-r0.
- Update cleanstart kube-state-metrics to version 2.16.0-r3.
- Update cleanstart kuberay-operator to version 1.3.2-r3.
- Update cleanstart kuberay-operator to version 1.4.2-r3.
- Update cleanstart kuberay-operator to version 1.5.2-r3.
- Update cleanstart kubernetes to version 1.33.11-r0.
- Update cleanstart kubernetes to version 1.34.7-r0.
- Update cleanstart kubernetes-csi-node-driver-registrar to version 2.13.0-r0.
- Update cleanstart kubernetes-event-exporter to version 1.7-r0.
- Update cleanstart kubernetes-replicator-fips to version 2.12.2-r0.
- Update cleanstart kured to version 1.20.0-r0.
- Update cleanstart local-path-provisioner to version 0.0.36-r1.
- Update cleanstart local-path-provisioner-fips to version 0.0.36-r1.
- Update cleanstart lvm-driver to version 1.7.0-r0.
- Update cleanstart metallb-fips to version 0.15.3-r0.
- Update cleanstart minio-client to version 0.20250721.052808-r1.
- Update cleanstart ollama to version 0.32.11-r2.
- Update cleanstart openbao-fips to version 2.3.2-r3.
- Update cleanstart openbao-fips to version 2.3.2-r4.
- Update cleanstart opensearch-k8s-operator-fips to version 2.5.1-r1.
- Update cleanstart opensearch-k8s-operator-fips to version 2.6.1-r7.
- Update cleanstart opensearch-k8s-operator-fips to version 2.7.0-r8.
- Update cleanstart percona-server-mongodb-operator to version 1.22.0-r1.
- Update cleanstart policy-controller-fips to version 0.13.1-r0.
- Update cleanstart postgres-operator to version 1.12.2-r2.
- Update cleanstart prometheus-pushgateway to version 1.10.0-r3.
- Update cleanstart prometheus-pushgateway-fips to version 1.10.0-r3.
- Update cleanstart rclone to version 1.69.0-r0.
- Update cleanstart runc to version 1.1.14-r0.
- Update cleanstart smarter-device-manager to version 1.1.2-r0.
- Update cleanstart smarter-device-manager-fips to version 1.20.12-r0.
- Update cleanstart spark-operator to version 2.2.1-r0.
- Update cleanstart spark-operator to version 2.4.0-r0.
- Update cleanstart stakater-reloader to version 1.4.13-r0.
- Update cleanstart timoni to version 0.25.2-r0.
- Update cleanstart velero-plugin-for-aws to version 1.10.1-r1.
- Update cleanstart velero-plugin-for-aws to version 1.12.2-r2.
- Update cleanstart velero-plugin-for-aws-fips to version 1.13.2-r1.
- Update cleanstart vertical-pod-autoscaler to version 1.5.1-r2.
- Update cleanstart wave-fips to version 0.10.0-r1.
- Update cleanstart whereabouts to version 0.9.2-r0.
- Update cleanstart yunikorn-k8shim to version 1.7.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-nifi |
< 2.10.0-r4 Fix: upgrade to 2.10.0-r4
|
| CleanStart | cleanstart | aws-efs-csi-driver |
< 2.2.0-r0 Fix: upgrade to 2.2.0-r0
|
| CleanStart | cleanstart | aws-privateca-issuer |
< 1.7.0-r0 Fix: upgrade to 1.7.0-r0
|
| CleanStart | cleanstart | aws-privateca-issuer-fips |
< 1.7.0-r0 Fix: upgrade to 1.7.0-r0
|
| CleanStart | cleanstart | cadvisor |
< 0.53.0-r0 < 0.54.1-r0 Fix: upgrade to 0.53.0-r0
|
| CleanStart | cleanstart | cfssl |
< 1.5.0-r1 Fix: upgrade to 1.5.0-r1
|
| CleanStart | cleanstart | cosign |
< 2.4.3-r0 < 2.5.3-r0 Fix: upgrade to 2.4.3-r0
|
| CleanStart | cleanstart | eks-distro-kube-apiserver |
< 1.34.2-r0 Fix: upgrade to 1.34.2-r0
|
| CleanStart | cleanstart | eks-distro-kube-apiserver-fips |
< 1.34.2-r0 Fix: upgrade to 1.34.2-r0
|
| CleanStart | cleanstart | envoy-ratelimit |
< 0.0.0_git20251231-r0 Fix: upgrade to 0.0.0_git20251231-r0
|
| CleanStart | cleanstart | external-dns |
< 0.18.0-r0 Fix: upgrade to 0.18.0-r0
|
| CleanStart | cleanstart | flux-notification-controller-fips |
< 1.5.0-r0 Fix: upgrade to 1.5.0-r0
|
| CleanStart | cleanstart | git-lfs-fips |
< 3.7.0-r2 Fix: upgrade to 3.7.0-r2
|
| CleanStart | cleanstart | hubble-ui |
< 0.13.3-r1 Fix: upgrade to 0.13.3-r1
|
| CleanStart | cleanstart | hubble-ui-fips |
< 0.13.3-r1 Fix: upgrade to 0.13.3-r1
|
| CleanStart | cleanstart | ip-masq-agent |
< 2.12.6-r1 Fix: upgrade to 2.12.6-r1
|
| CleanStart | cleanstart | k8ssandra-operator |
< 1.26.0-r0 Fix: upgrade to 1.26.0-r0
|
| CleanStart | cleanstart | k8ssandra-operator-fips |
< 1.29.0-r1 Fix: upgrade to 1.29.0-r1
|
| CleanStart | cleanstart | karpenter-fips |
< 1.8.6-r0 Fix: upgrade to 1.8.6-r0
|
| CleanStart | cleanstart | kserve-rest-proxy |
< 0.12.0-r3 Fix: upgrade to 0.12.0-r3
|
| CleanStart | cleanstart | kube-fluentd-operator |
< 1.18.2-r0 Fix: upgrade to 1.18.2-r0
|
| CleanStart | cleanstart | kube-state-metrics |
< 2.10.1-r0 < 2.16.0-r3 Fix: upgrade to 2.10.1-r0
|
| CleanStart | cleanstart | kuberay-operator |
< 1.3.2-r3 < 1.4.2-r3 < 1.5.2-r3 Fix: upgrade to 1.3.2-r3
|
| CleanStart | cleanstart | kubernetes |
< 1.33.11-r0 < 1.34.7-r0 Fix: upgrade to 1.33.11-r0
|
| CleanStart | cleanstart | kubernetes-csi-node-driver-registrar |
< 2.13.0-r0 Fix: upgrade to 2.13.0-r0
|
| CleanStart | cleanstart | kubernetes-event-exporter |
< 1.7-r0 Fix: upgrade to 1.7-r0
|
| CleanStart | cleanstart | kubernetes-replicator-fips |
< 2.12.2-r0 Fix: upgrade to 2.12.2-r0
|
| CleanStart | cleanstart | kured |
< 1.20.0-r0 Fix: upgrade to 1.20.0-r0
|
| CleanStart | cleanstart | local-path-provisioner |
< 0.0.36-r1 Fix: upgrade to 0.0.36-r1
|
| CleanStart | cleanstart | local-path-provisioner-fips |
< 0.0.36-r1 Fix: upgrade to 0.0.36-r1
|
| CleanStart | cleanstart | lvm-driver |
< 1.7.0-r0 Fix: upgrade to 1.7.0-r0
|
| CleanStart | cleanstart | metallb-fips |
< 0.15.3-r0 Fix: upgrade to 0.15.3-r0
|
| CleanStart | cleanstart | minio-client |
< 0.20250721.052808-r1 Fix: upgrade to 0.20250721.052808-r1
|
| CleanStart | cleanstart | ollama |
< 0.32.11-r2 Fix: upgrade to 0.32.11-r2
|
| CleanStart | cleanstart | openbao-fips |
< 2.3.2-r3 < 2.3.2-r4 Fix: upgrade to 2.3.2-r3
|
| CleanStart | cleanstart | opensearch-k8s-operator-fips |
< 2.5.1-r1 < 2.6.1-r7 < 2.7.0-r8 Fix: upgrade to 2.5.1-r1
|
| CleanStart | cleanstart | percona-server-mongodb-operator |
< 1.22.0-r1 Fix: upgrade to 1.22.0-r1
|
| CleanStart | cleanstart | policy-controller-fips |
< 0.13.1-r0 Fix: upgrade to 0.13.1-r0
|
| CleanStart | cleanstart | postgres-operator |
< 1.12.2-r2 Fix: upgrade to 1.12.2-r2
|
| CleanStart | cleanstart | prometheus-pushgateway |
< 1.10.0-r3 Fix: upgrade to 1.10.0-r3
|
| CleanStart | cleanstart | prometheus-pushgateway-fips |
< 1.10.0-r3 Fix: upgrade to 1.10.0-r3
|
| CleanStart | cleanstart | rclone |
< 1.69.0-r0 Fix: upgrade to 1.69.0-r0
|
| CleanStart | cleanstart | runc |
< 1.1.14-r0 Fix: upgrade to 1.1.14-r0
|
| CleanStart | cleanstart | smarter-device-manager |
< 1.1.2-r0 Fix: upgrade to 1.1.2-r0
|
| CleanStart | cleanstart | smarter-device-manager-fips |
< 1.20.12-r0 Fix: upgrade to 1.20.12-r0
|
| CleanStart | cleanstart | spark-operator |
< 2.2.1-r0 < 2.4.0-r0 Fix: upgrade to 2.2.1-r0
|
| CleanStart | cleanstart | stakater-reloader |
< 1.4.13-r0 Fix: upgrade to 1.4.13-r0
|
| CleanStart | cleanstart | timoni |
< 0.25.2-r0 Fix: upgrade to 0.25.2-r0
|
| CleanStart | cleanstart | velero-plugin-for-aws |
< 1.10.1-r1 < 1.12.2-r2 Fix: upgrade to 1.10.1-r1
|
| CleanStart | cleanstart | velero-plugin-for-aws-fips |
< 1.13.2-r1 Fix: upgrade to 1.13.2-r1
|
Showing 50 of 54. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | vertical-pod-autoscaler |
< 1.5.1-r2 Fix: upgrade to 1.5.1-r2
|
| CleanStart | cleanstart | wave-fips |
< 0.10.0-r1 Fix: upgrade to 0.10.0-r1
|
| CleanStart | cleanstart | whereabouts |
< 0.9.2-r0 Fix: upgrade to 0.9.2-r0
|
| CleanStart | cleanstart | yunikorn-k8shim |
< 1.7.0-r0 Fix: upgrade to 1.7.0-r0
|
Original advisory text
Security fix for CVE-2025-58190 applied in: apache-nifi 2.10.0-r4, aws-efs-csi-driver 2.2.0-r0, aws-privateca-issuer 1.7.0-r0, aws-privateca-issuer-fips 1.7.0-r0, cadvisor 0.53.0-r0, cadvisor 0.54.1-r0, cfssl 1.5.0-r1, cosign 2.4.3-r0, cosign 2.5.3-r0, eks-distro-kube-apiserver 1.34.2-r0, eks-distro-kube-apiserver-fips 1.34.2-r0, envoy-ratelimit 0.0.0_git20251231-r0, external-dns 0.18.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r2, hubble-ui 0.13.3-r1, hubble-ui-fips 0.13.3-r1, ip-masq-agent 2.12.6-r1, k8ssandra-operator 1.26.0-r0, k8ssandra-operator-fips 1.29.0-r1, karpenter-fips 1.8.6-r0, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-state-metrics 2.10.1-r0, kube-state-metrics 2.16.0-r3, kuberay-operator 1.3.2-r3, kuberay-operator 1.4.2-r3, kuberay-operator 1.5.2-r3, kubernetes 1.33.11-r0, kubernetes 1.34.7-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-event-exporter 1.7-r0, kubernetes-replicator-fips 2.12.2-r0, kured 1.20.0-r0, local-path-provisioner 0.0.36-r1, local-path-provisioner-fips 0.0.36-r1, lvm-driver 1.7.0-r0, metallb-fips 0.15.3-r0, minio-client 0.20250721.052808-r1, ollama 0.32.11-r2, openbao-fips 2.3.2-r3, openbao-fips 2.3.2-r4, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, percona-server-mongodb-operator 1.22.0-r1, policy-controller-fips 0.13.1-r0, postgres-operator 1.12.2-r2, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway-fips 1.10.0-r3, rclone 1.69.0-r0, runc 1.1.14-r0, smarter-device-manager 1.1.2-r0, smarter-device-manager-fips 1.20.12-r0, spark-operator 2.2.1-r0, spark-operator 2.4.0-r0, stakater-reloader 1.4.13-r0, timoni 0.25.2-r0, velero-plugin-for-aws 1.10.1-r1, velero-plugin-for-aws 1.12.2-r2, velero-plugin-for-aws-fips 1.13.2-r1, vertical-pod-autoscaler 1.5.1-r2, wave-fips 0.10.0-r1, whereabouts 0.9.2-r0, yunikorn-k8shim 1.7.0-r0
CVE-2025-58190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-AS73469 · OSV
Track software like this
Free during beta