CLEANSTART-2026-ID88447 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

🗓️ 01 Oct 2026 00:35:28Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Authorization bypass in kube-state-metrics-fips skips source-address validation.

Reporter	Title	Published	Views	Family All 1000
GithubExploit	Exploit for Incorrect Implementation of Authentication Algorithm in Golang Crypto	25 Sep 202621:28	–	githubexploit
IBM Security Bulletins	Security Bulletin: Vulnerabilities in golang.org/x/crypto bundled with IBM Fusion and IBM Fusion HCI.	5 Oct 202619:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management	29 Sep 202616:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL	24 Jul 202622:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to multiple vulnerabilities	3 Aug 202608:33	–	ibm
attackerkb	CVE-2026-46595	22 May 202602:31	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : docker (ALAS2023-2026-1783)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1784)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nerdctl (ALAS2023-2026-1788)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1809)	8 Jun 202600:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ID88447.json
osv	www.osv.dev/vulnerability/CVE-2026-46595
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-46595

01 Oct 2026 01:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.00503

kube-state-metrics-fips authorization bypass source-address validation