Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Prometheus Redis Exporter and Temporal Server can accept forged signatures
published 1 month ago
Summary
Both the Prometheus Redis Exporter and Temporal Server may incorrectly validate specially crafted data, allowing attackers to forge digital signatures. This could let unauthorized users appear trusted and potentially alter data or actions. Update to the latest patched versions as soon as they are available to restore proper signature checking.
What to do
- Update cleanstart prometheus-redis-exporter-fips to version 1.92.1-r0.
- Update cleanstart temporal-server to version 1.31.3-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | prometheus-redis-exporter-fips |
< 1.92.1-r0 Fix: upgrade to 1.92.1-r0
|
| CleanStart | cleanstart | temporal-server |
< 1.31.3-r1 Fix: upgrade to 1.31.3-r1
|
Original advisory text
For certain crafted inputs, a 'ed25519
CVE-2026-46598 affects multiple packages. For certain crafted inputs, a 'ed25519. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-IZ71497 · OSV
Track software like this
Free during beta