CLEANSTART-2026-IO10206 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

🗓️ 01 Oct 2026 00:35:23Reported by GoogleType

osv🔗 osv.dev👁 4 Views

In-memory keyring in kube-state-metrics-fips silently accepts but fails to enforce keys.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Vulnerabilities in golang.org/x/crypto bundled with IBM Fusion and IBM Fusion HCI.	5 Oct 202619:30	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Golang Go, multiple vulnerabilities affect IBM Cloud Pak System	7 Oct 202623:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL	24 Jul 202622:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to multiple vulnerabilities	3 Aug 202608:33	–	ibm
attackerkb	CVE-2026-39833	22 May 202602:31	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : docker (ALAS2023-2026-1783)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1784)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nerdctl (ALAS2023-2026-1788)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1809)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : rclone (ALAS2023-2026-1810)	8 Jun 202600:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IO10206.json
osv	www.osv.dev/vulnerability/CVE-2026-39833
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-39833

08 Oct 2026 16:47Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.19.8

EPSS0.00487

kube-state-metrics-fips NewKeyring()ConfirmBeforeUse in-memory keyring