Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Cosign, Kubescape, Kyverno tools need update to stay safe

published 1 month ago
Summary

The listed cleanstart products—Cosign, Kubescape, Kyverno‑FIPS, Kyverno‑Policy‑Reporter plugin, and Sigstore scaffolding—contain a flaw that could be exploited by attackers. Updating each package to the newest release removes the risk. Apply the latest versions as soon as possible.

What to do
  • Update cleanstart cosign to version 2.4.3-r0.
  • Update cleanstart cosign to version 2.5.3-r0.
  • Update cleanstart kubescape to version 3.0.47-r0.
  • Update cleanstart kyverno-fips to version 1.16.3-r3.
  • Update cleanstart kyverno-policy-reporter-kyverno-plugin-fips to version 1.4.2-r7.
  • Update cleanstart sigstore-scaffolding to version 0.7.31-r2.
  • Update cleanstart tkn to version 0.42.2-r1.
  • Update cleanstart tkn to version 0.43.2-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart cosign < 2.4.3-r0
< 2.5.3-r0
Fix: upgrade to 2.4.3-r0
CleanStart cleanstart kubescape < 3.0.47-r0
Fix: upgrade to 3.0.47-r0
CleanStart cleanstart kyverno-fips < 1.16.3-r3
Fix: upgrade to 1.16.3-r3
CleanStart cleanstart kyverno-policy-reporter-kyverno-plugin-fips < 1.4.2-r7
Fix: upgrade to 1.4.2-r7
CleanStart cleanstart sigstore-scaffolding < 0.7.31-r2
Fix: upgrade to 0.7.31-r2
CleanStart cleanstart tkn < 0.42.2-r1
< 0.43.2-r1
Fix: upgrade to 0.42.2-r1
Original advisory text
Security fix for CVE-2026-22772 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, kubescape 3.0.47-r0, kyverno-fips 1.16.3-r3, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r7, sigstore-scaffolding 0.7.31-r2, tkn 0.42.2-r1, tkn 0.43.2-r1
CVE-2026-22772 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-NY15561 · OSV
Track software like this
Free during beta