CLEANSTART-2026-RU37744

Dashboard / Vulnerabilities / CLEANSTART-2026-RU37744

CLEANSTART-2026-RU37744

Summary: Security fix for GHSA-5cv4-jp36-h3mw applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, ip-masq-agent 2.12.0-r1, melange 0.55.0-r1, litestream 0.5.14-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, falco-exporter 0.8.7-r2, k8sgpt 0.1.8-r2, k8sgpt-operator 0.2.27-r1, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, node-problem-detector 1.35.2-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, promxy 0.0.96-r2, promxy 0.0.96-r3, thanos-operator 0.3.7-r1, thanos-operator-fips 0.3.7-r1, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, grafana-agent-operator 0.44.3-r1, kube-logging-operator 6.4.0-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, multus-cni-fips 4.3.0-r1

Details: GHSA-5cv4-jp36-h3mw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References: https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RU37744.json, https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw