CLEANSTART-2026-JH93057 Security fixes for CVE-2025-61727, CVE-2025-61729, CVE-2026-24051, CVE-2026-33186, CVE-2026-39883, ghsa-6v2p-p543-phr9, ghsa-f6x5-jh6r-wrfv, ghsa-hfvc-g4fc-pqhx, ghsa-j5w8-q4qc-rx2x, ghsa-mh2q-q3fh-2475, ghsa-p77j-4mvh-x3m3 applied in versions: 0.57.0-r0, 0.59.0-r0, 0.59.0-r1

🗓️ 18 May 2026 13:57:37Reported by GoogleType

osv

osv🔗 osv.dev👁 29 Views

Kapp-controller fixes for multiple CVEs; affected versions 0.57.0-r0 and 0.59.0-r0/r1.

Reporter	Title	Published	Views	Family All 5822
OSV	GHSA-9H8M-3FM2-QJRQ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking	2 Feb 202620:07	–	osv
OSV	GHSA-HFVC-G4FC-PQHX opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking	8 Apr 202619:22	–	osv
OSV	GHSA-MJCP-GPGX-GGCG OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs	9 Dec 202522:48	–	osv
OSV	GHSA-P77J-4MVH-X3M3 gRPC-Go has an authorization bypass via missing leading slash in :path	18 Mar 202620:10	–	osv
OSV	GO-2025-4155 Excessive resource consumption when printing error string for host certificate validation in crypto/x509	2 Dec 202518:30	–	osv
OSV	GO-2025-4175 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509	2 Dec 202520:55	–	osv
OSV	GO-2025-4224 OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu	15 Dec 202520:15	–	osv
OSV	GO-2026-4394 OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk	19 Feb 202617:28	–	osv
OSV	GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc	27 Mar 202618:39	–	osv
OSV	GO-2026-4897 Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik	2 Apr 202618:42	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JH93057.json
osv	www.osv.dev/vulnerability/CVE-2025-61727
osv	www.osv.dev/vulnerability/CVE-2025-61729
osv	www.osv.dev/vulnerability/CVE-2026-24051
osv	www.osv.dev/vulnerability/CVE-2026-33186
osv	www.osv.dev/vulnerability/CVE-2026-39883
osv	www.osv.dev/vulnerability/ghsa-6v2p-p543-phr9
osv	www.osv.dev/vulnerability/ghsa-f6x5-jh6r-wrfv
osv	www.osv.dev/vulnerability/ghsa-hfvc-g4fc-pqhx
osv	www.osv.dev/vulnerability/ghsa-j5w8-q4qc-rx2x

28 May 2026 22:15Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17 - 9.1

CVSS 47.3

EPSS0.01557

SSVC

kapp controller security fixes cve 2025 61727 cve 2025 61729 cve 2026 24051 cve 2026 33186 cve 2026 39883 ghsa advisories library