Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache NiFi, Argo CD, Cert‑Manager updates prevent remote code execution
published 1 month ago
Summary
Recent versions of Apache NiFi, Argo CD (including FIPS builds), and Cert‑Manager (including FIPS builds) have been updated to stop an issue that could let an attacker run code on your system. The problem has been fixed in the newer releases, so upgrade to the indicated versions as soon as possible. Keeping these components up to date protects your environment from unauthorized access and potential data loss.
What to do
- Update cleanstart apache-nifi to version 2.10.0-r4.
- Update cleanstart argo-cd to version 2.14.20-r0.
- Update cleanstart argo-cd-fips to version 2.13.9-r3.
- Update cleanstart argo-cd-fips to version 2.14.20-r0.
- Update cleanstart argo-cd-fips to version 3.1.9-r0.
- Update cleanstart cert-manager-cmctl-fips to version 2.4.0-r1.
- Update cleanstart cert-manager-fips to version 1.18.2-r0.
- Update cleanstart cert-manager-fips to version 1.19.1-r0.
- Update cleanstart cert-manager-webhook-pdns-fips to version 2.2.0-r0.
- Update cleanstart chartmuseum-fips to version 0.15.0-r4.
- Update cleanstart chartmuseum-fips to version 0.16.3-r3.
- Update cleanstart cni-plugin-flannel to version 1.6.0-r0.
- Update cleanstart cosign to version 2.4.3-r0.
- Update cleanstart cosign to version 2.5.3-r0.
- Update cleanstart dex-fips to version 2.41.1-r4.
- Update cleanstart dex-fips to version 2.42.1-r4.
- Update cleanstart dex-fips to version 2.43.1-r4.
- Update cleanstart druid-exporter-fips to version 0.11-r2.
- Update cleanstart eck-operator-fips to version 3.2.0-r0.
- Update cleanstart external-dns-fips to version 0.20.0-r0.
- Update cleanstart flux-notification-controller-fips to version 1.5.0-r0.
- Update cleanstart git-lfs-fips to version 3.7.0-r0.
- Update cleanstart go-discover-fips to version 0_git20250325-r0.
- Update cleanstart go-fips-1.24 to version 1.24.9-r0.
- Update cleanstart go-fips-1.25 to version 1.25.1-r0.
- Update cleanstart harbor-registry to version 3.0.0.1-r2.
- Update cleanstart harbor-registry-fips to version 3.0.0-r1.
- Update cleanstart helm to version 3.19.0-r0.
- Update cleanstart helm-fips to version 3.19.0-r0.
- Update cleanstart helm-operator to version 1.41.1-r0.
- Update cleanstart k8ssandra-client-fips to version 0.7.0-r2.
- Update cleanstart k8ssandra-client-fips to version 0.7.0-r4.
- Update cleanstart k8ssandra-operator to version 1.26.0-r0.
- Update cleanstart kube-rbac-proxy-fips to version 0.19.1-r1.
- Update cleanstart kube-state-metrics to version 2.16.0-r3.
- Update cleanstart kubernetes to version 1.34.1-r0.
- Update cleanstart kubernetes-csi-node-driver-registrar to version 2.13.0-r0.
- Update cleanstart kured to version 1.20.0-r0.
- Update cleanstart kustomize-fips to version 5.7.1-r0.
- Update cleanstart kyverno to version 1.15.2-r0.
- Update cleanstart logstash-exporter to version 1.9.1-r0.
- Update cleanstart metallb to version 0.14.9-r0.
- Update cleanstart metallb to version 0.15.2-r0.
- Update cleanstart minio-operator to version 7.1.1-r0.
- Update cleanstart modelmesh-runtime-adapter to version 0.12.0-r0.
- Update cleanstart modelmesh-runtime-adapter to version 0.12.0-r1.
- Update cleanstart nvidia-container-toolkit to version 1.19.0-r0.
- Update cleanstart opensearch-k8s-operator-fips to version 2.5.1-r1.
- Update cleanstart opensearch-k8s-operator-fips to version 2.6.1-r7.
- Update cleanstart opensearch-k8s-operator-fips to version 2.7.0-r8.
- Update cleanstart prometheus-node-exporter to version 1.8.0-r3.
- Update cleanstart runc to version 1.1.14-r0.
- Update cleanstart spark-operator to version 2.2.1-r0.
- Update cleanstart stakater-reloader to version 1.4.8-r0.
- Update cleanstart step to version 0.28.7-r1.
- Update cleanstart step-cli to version 0.28.7-r1.
- Update cleanstart step-issuer to version 0.9.9-r1.
- Update cleanstart step-issuer-fips to version 0.9.11-r1.
- Update cleanstart vault-k8s to version 1.7.0-r0.
- Update cleanstart velero to version 1.17.0-r0.
- Update cleanstart velero-plugin-for-aws to version 1.13.0-r0.
- Update cleanstart velero-plugin-for-csi to version 0.7.1-r0.
- Update cleanstart wave to version 0.10.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-nifi |
< 2.10.0-r4 Fix: upgrade to 2.10.0-r4
|
| CleanStart | cleanstart | argo-cd |
< 2.14.20-r0 Fix: upgrade to 2.14.20-r0
|
| CleanStart | cleanstart | argo-cd-fips |
< 2.13.9-r3 < 2.14.20-r0 < 3.1.9-r0 Fix: upgrade to 2.13.9-r3
|
| CleanStart | cleanstart | cert-manager-cmctl-fips |
< 2.4.0-r1 Fix: upgrade to 2.4.0-r1
|
| CleanStart | cleanstart | cert-manager-fips |
< 1.18.2-r0 < 1.19.1-r0 Fix: upgrade to 1.18.2-r0
|
| CleanStart | cleanstart | cert-manager-webhook-pdns-fips |
< 2.2.0-r0 Fix: upgrade to 2.2.0-r0
|
| CleanStart | cleanstart | chartmuseum-fips |
< 0.15.0-r4 < 0.16.3-r3 Fix: upgrade to 0.15.0-r4
|
| CleanStart | cleanstart | cni-plugin-flannel |
< 1.6.0-r0 Fix: upgrade to 1.6.0-r0
|
| CleanStart | cleanstart | cosign |
< 2.4.3-r0 < 2.5.3-r0 Fix: upgrade to 2.4.3-r0
|
| CleanStart | cleanstart | dex-fips |
< 2.41.1-r4 < 2.42.1-r4 < 2.43.1-r4 Fix: upgrade to 2.41.1-r4
|
| CleanStart | cleanstart | druid-exporter-fips |
< 0.11-r2 Fix: upgrade to 0.11-r2
|
| CleanStart | cleanstart | eck-operator-fips |
< 3.2.0-r0 Fix: upgrade to 3.2.0-r0
|
| CleanStart | cleanstart | external-dns-fips |
< 0.20.0-r0 Fix: upgrade to 0.20.0-r0
|
| CleanStart | cleanstart | flux-notification-controller-fips |
< 1.5.0-r0 Fix: upgrade to 1.5.0-r0
|
| CleanStart | cleanstart | git-lfs-fips |
< 3.7.0-r0 Fix: upgrade to 3.7.0-r0
|
| CleanStart | cleanstart | go-discover-fips |
< 0_git20250325-r0 Fix: upgrade to 0_git20250325-r0
|
| CleanStart | cleanstart | go-fips-1.24 |
< 1.24.9-r0 Fix: upgrade to 1.24.9-r0
|
| CleanStart | cleanstart | go-fips-1.25 |
< 1.25.1-r0 Fix: upgrade to 1.25.1-r0
|
| CleanStart | cleanstart | harbor-registry |
< 3.0.0.1-r2 Fix: upgrade to 3.0.0.1-r2
|
| CleanStart | cleanstart | harbor-registry-fips |
< 3.0.0-r1 Fix: upgrade to 3.0.0-r1
|
| CleanStart | cleanstart | helm |
< 3.19.0-r0 Fix: upgrade to 3.19.0-r0
|
| CleanStart | cleanstart | helm-fips |
< 3.19.0-r0 Fix: upgrade to 3.19.0-r0
|
| CleanStart | cleanstart | helm-operator |
< 1.41.1-r0 Fix: upgrade to 1.41.1-r0
|
| CleanStart | cleanstart | k8ssandra-client-fips |
< 0.7.0-r2 < 0.7.0-r4 Fix: upgrade to 0.7.0-r2
|
| CleanStart | cleanstart | k8ssandra-operator |
< 1.26.0-r0 Fix: upgrade to 1.26.0-r0
|
| CleanStart | cleanstart | kube-rbac-proxy-fips |
< 0.19.1-r1 Fix: upgrade to 0.19.1-r1
|
| CleanStart | cleanstart | kube-state-metrics |
< 2.16.0-r3 Fix: upgrade to 2.16.0-r3
|
| CleanStart | cleanstart | kubernetes |
< 1.34.1-r0 Fix: upgrade to 1.34.1-r0
|
| CleanStart | cleanstart | kubernetes-csi-node-driver-registrar |
< 2.13.0-r0 Fix: upgrade to 2.13.0-r0
|
| CleanStart | cleanstart | kured |
< 1.20.0-r0 Fix: upgrade to 1.20.0-r0
|
| CleanStart | cleanstart | kustomize-fips |
< 5.7.1-r0 Fix: upgrade to 5.7.1-r0
|
| CleanStart | cleanstart | kyverno |
< 1.15.2-r0 Fix: upgrade to 1.15.2-r0
|
| CleanStart | cleanstart | logstash-exporter |
< 1.9.1-r0 Fix: upgrade to 1.9.1-r0
|
| CleanStart | cleanstart | metallb |
< 0.14.9-r0 < 0.15.2-r0 Fix: upgrade to 0.14.9-r0
|
| CleanStart | cleanstart | minio-operator |
< 7.1.1-r0 Fix: upgrade to 7.1.1-r0
|
| CleanStart | cleanstart | modelmesh-runtime-adapter |
< 0.12.0-r0 < 0.12.0-r1 Fix: upgrade to 0.12.0-r0
|
| CleanStart | cleanstart | nvidia-container-toolkit |
< 1.19.0-r0 Fix: upgrade to 1.19.0-r0
|
| CleanStart | cleanstart | opensearch-k8s-operator-fips |
< 2.5.1-r1 < 2.6.1-r7 < 2.7.0-r8 Fix: upgrade to 2.5.1-r1
|
| CleanStart | cleanstart | prometheus-node-exporter |
< 1.8.0-r3 Fix: upgrade to 1.8.0-r3
|
| CleanStart | cleanstart | runc |
< 1.1.14-r0 Fix: upgrade to 1.1.14-r0
|
| CleanStart | cleanstart | spark-operator |
< 2.2.1-r0 Fix: upgrade to 2.2.1-r0
|
| CleanStart | cleanstart | stakater-reloader |
< 1.4.8-r0 Fix: upgrade to 1.4.8-r0
|
| CleanStart | cleanstart | step |
< 0.28.7-r1 Fix: upgrade to 0.28.7-r1
|
| CleanStart | cleanstart | step-cli |
< 0.28.7-r1 Fix: upgrade to 0.28.7-r1
|
| CleanStart | cleanstart | step-issuer |
< 0.9.9-r1 Fix: upgrade to 0.9.9-r1
|
| CleanStart | cleanstart | step-issuer-fips |
< 0.9.11-r1 Fix: upgrade to 0.9.11-r1
|
| CleanStart | cleanstart | vault-k8s |
< 1.7.0-r0 Fix: upgrade to 1.7.0-r0
|
| CleanStart | cleanstart | velero |
< 1.17.0-r0 Fix: upgrade to 1.17.0-r0
|
| CleanStart | cleanstart | velero-plugin-for-aws |
< 1.13.0-r0 Fix: upgrade to 1.13.0-r0
|
| CleanStart | cleanstart | velero-plugin-for-csi |
< 0.7.1-r0 Fix: upgrade to 0.7.1-r0
|
Showing 50 of 51. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | wave |
< 0.10.0-r0 Fix: upgrade to 0.10.0-r0
|
Original advisory text
Security fix for CVE-2025-58183 applied in: apache-nifi 2.10.0-r4, argo-cd 2.14.20-r0, argo-cd-fips 2.13.9-r3, argo-cd-fips 2.14.20-r0, argo-cd-fips 3.1.9-r0, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cni-plugin-flannel 1.6.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, druid-exporter-fips 0.11-r2, eck-operator-fips 3.2.0-r0, external-dns-fips 0.20.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.24 1.24.9-r0, go-fips-1.25 1.25.1-r0, harbor-registry 3.0.0.1-r2, harbor-registry-fips 3.0.0-r1, helm 3.19.0-r0, helm-fips 3.19.0-r0, helm-operator 1.41.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kubernetes 1.34.1-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kured 1.20.0-r0, kustomize-fips 5.7.1-r0, kyverno 1.15.2-r0, logstash-exporter 1.9.1-r0, metallb 0.14.9-r0, metallb 0.15.2-r0, minio-operator 7.1.1-r0, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0, stakater-reloader 1.4.8-r0, step 0.28.7-r1, step-cli 0.28.7-r1, step-issuer 0.9.9-r1, step-issuer-fips 0.9.11-r1, vault-k8s 1.7.0-r0, velero 1.17.0-r0, velero-plugin-for-aws 1.13.0-r0, velero-plugin-for-csi 0.7.1-r0, wave 0.10.0-r0
CVE-2025-58183 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-RU56468 · OSV
Track software like this
Free during beta