Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Grafana, RabbitMQ, Kyverno may accept forged tokens
published 2 days ago
Summary
The Go JOSE library used by Grafana, the RabbitMQ messaging topology operator, and Kyverno can be tricked into accepting forged or altered security tokens. This could let unauthorized users gain access or perform actions they should not be allowed to. Update the affected packages to the latest versions that fix the issue or apply the recommended patches.
What to do
- Update cleanstart grafana to version 13.1.9-r0.
- Update cleanstart rabbitmq-messaging-topology-operator to version 1.20.5-r1.
- Update cleanstart kyverno to version 1.18.2-r5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | grafana |
< 13.1.9-r0 Fix: upgrade to 13.1.9-r0
|
| CleanStart | cleanstart | rabbitmq-messaging-topology-operator |
< 1.20.5-r1 Fix: upgrade to 1.20.5-r1
|
| CleanStart | cleanstart | kyverno |
< 1.18.2-r5 Fix: upgrade to 1.18.2-r5
|
Original advisory text
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
CVE-2026-116586 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published3 Nov 2026
Updated3 Nov 2026
First seen3 Nov 2026
Sources
CLEANSTART-2026-WE07714 · OSV
Track software like this
Free during beta