CLEANSTART-2026-MR47110 Security fix for GHSA-9c54-x2g4-v92j applied in: cosign 3.1.2-r1, spire-server-fips 1.15.1-r1

GHSA-9c54-x2g4-v92j affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OY65007 Security fix for GHSA-9vcr-p3rj-q5q6 applied in: cosign 3.1.2-r1, spire-server-fips 1.15.1-r1

GHSA-9vcr-p3rj-q5q6 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UK76839 Security fix for GHSA-47q9-m4ww-924m applied in: cosign 3.1.2-r1, spire-server-fips 1.15.1-r1

GHSA-47q9-m4ww-924m affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HF60121 Security fix for CVE-2026-54787 applied in: cosign 2.6.4-r2, cosign 3.1.2-r1, crossplane 2.3.4-r2, kyverno 1.16.4-r3, kyverno 1.17.2-r2, kyverno 1.18.1-r4, policy-controller-fips 0.15.1-r1, spire-server 1.14.7-r0, tekton-chains 0.25.2-r1, tekton-chains 0.26.5-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1

CVE-2026-54787 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DH56111 Security fix for CVE-2026-33818 applied in: access-log-exporter 0.1.15-r1, access-log-exporter 0.2.0-r0, access-log-exporter 0.3.20-r0, argo-cd 3.2.12-r5, argo-cd-fips 3.4.7-r3, argo-rollouts-fips 1.9.1-r3, argo-workflows 3.7.17-r3, atlantis-fips 0.47.1-r1, aws-network-policy-agent 1.1.6-r3, boring-registry 0.18.0-r0, boring-registry-fips 0.17.0-r2, boring-registry-fips 0.18.0-r0, cadvisor 0.55.1-r5, cadvisor 0.56.2-r3, cadvisor 0.57.0-r5, cadvisor 0.60.5-r1, calico 3.30.7-r7, calico 3.31.6-r2, calico 3.32.1-r3, cert-manager 1.18.6-r5, cert-manager 1.19.6-r3, cert-manager 1.20.3-r4, cert-manager 1.21.1-r0, cloudnative-pg 1.27.4-r2, cloudnative-pg 1.28.4-r1, cloudnative-pg 1.29.2-r2, cloudnative-pg 1.30.0-r1, configmap-reload 0.15.0-r3, cortex 1.18.1-r5, cortex 1.20.1-r4, cosign 2.6.5-r2, cosign 3.0.6-r2, cosign 3.1.3-r0, dex 2.43.1-r3, dex 2.44.0-r8, dynatrace-operator 1.10.1-r1, dynatrace-operator 1.10.2-r0, dynatrace-operator 1.8.1-r7, elastic-beats 9.2.8-r8, elastic-beats 9.3.8-r1, external-secrets-operator 2.6.0-r5, external-secrets-operator 2.7.0-r3, external-secrets-operator 2.8.0-r2, fluent-operator-fips 3.10.0-r3, fulcio-fips 1.5.1-r3, fulcio-fips 1.6.6-r2, fulcio-fips 1.7.1-r3, git-lfs-fips 3.7.1-r1, gitea 1.26.4-r1, go-discover 0_git20250325-r4, gomplate 4.3.3-r3, gosu 1.19-r5, grafana-org-operator 1.13.0-r2, haproxy-ingress 0.13.19-r2, haproxy-ingress 0.14.12-r3, haproxy-ingress 0.15.4-r5, haproxy-ingress 0.16.1-r5, helm 3.21.4-r2, helm 4.0.5-r6, helm 4.1.4-r3, helm 4.2.3-r1, helm-fips 3.21.4-r0, helm-fips 4.2.4-r0, helm-operator 1.39.2-r2, helm-operator 1.40.0-r2, helm-operator 1.42.2-r4, helm-operator 1.42.3-r3, ingress-nginx-controller 1.12.8-r1, ingress-nginx-controller 1.13.9-r1, ingress-nginx-controller 1.14.5-r4, ingress-nginx-controller 1.15.1-r3, istio 1.29.6-r2, istio 1.30.3-r2, knative-net-istio 1.20.4-r3, knative-net-istio 1.21.4-r3, knative-net-istio 1.22.1-r1, knative-net-istio 1.23.0-r0, knative-serving 1.20.3-r1, knative-serving 1.21.3-r2, knative-serving 1.22.1-r3, knative-serving 1.23.0-r0, kube-metrics-adapter 0.2.9-r1, kube-state-metrics 2.16.0-r10, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-state-metrics-fips 2.20.0-r2, kube-vip 0.9.2-r1, kube-vip 1.0.4-r2, kube-vip 1.1.2-r4, kube-vip-fips 0.9.2-r1, kubernetes 1.33.13-r1, kubernetes 1.34.10-r5, kubernetes 1.35.7-r1, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-dns-node-cache 1.23.1-r1, kubernetes-dns-node-cache 1.24.1-r2, kubernetes-dns-node-cache 1.25.0-r9, kubernetes-dns-node-cache 1.26.8-r7, kustomize-fips 5.8.1-r1, local-path-provisioner-fips 0.0.36-r3, logstash-exporter 1.6.4-r1, logstash-exporter 1.7.1-r2, logstash-exporter 1.8.4-r2, logstash-exporter 1.9.1-r4, logstash-exporter-fips 1.6.4-r1, logstash-exporter-fips 1.7.1-r1, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, memcached-exporter 0.16.0-r2, metallb 0.13.12-r5, metallb 0.14.9-r4, metallb 0.15.3-r2, metallb 0.16.0-r3, minio-operator 6.0.4-r7, minio-operator 7.0.1-r7, minio-operator 7.1.1-r7, mongodb 8.0.29-r0, mongodb 8.1.3-r3, mongodb 8.3.8-r0, nats-streaming 0.22.1-r2, nats-streaming 0.23.2-r2, nats-streaming 0.24.6-r5, nats-streaming 0.25.6-r6, nginx-prometheus-exporter-fips 1.5.3-r1, ollama-fips 0.32.11-r1, ollama-fips 0.32.12-r1, ollama-fips 0.32.14-r1, ollama-fips 0.32.15-r2, opa-fips 1.19.1-r2, opentelemetry-collector-contrib 0.156.0-r0, opentelemetry-collector-contrib-fips 0.158.0-r3, opentelemetry-collector-contrib-fips 0.159.0-r2, prometheus 3.10.0-r8, prometheus 3.11.3-r6, prometheus-alertmanager 0.33.0-r2, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, prometheus-fips 3.12.0-r3, prometheus-mongodb-exporter-fips 0.53.0-r1, prometheus-mysqld-exporter 0.17.2-r5, prometheus-mysqld-exporter 0.18.0-r5, prometheus-mysqld-exporter 0.19.0-r4, prometheus-node-exporter 1.10.2-r4, prometheus-node-exporter 1.11.1-r3, prometheus-node-exporter 1.12.1-r1, prometheus-node-exporter 1.9.1-r4, prometheus-node-exporter-fips 1.10.2-r3, prometheus-node-exporter-fips 1.11.1-r2, prometheus-operator 0.90.1-r3, prometheus-operator 0.91.0-r4, prometheus-operator 0.92.1-r2, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r3, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter 1.86.0-r2, prometheus-redis-exporter 1.87.0-r1, prometheus-redis-exporter 1.88.0-r3, prometheus-redis-exporter-fips 1.87.0-r3, prometheus-statsd-exporter 0.27.2-r1, prometheus-statsd-exporter 0.28.0-r3, prometheus-statsd-exporter 0.29.0-r0, rabbitmq-cluster-operator 2.20.1-r6, rabbitmq-cluster-operator 2.21.1-r3, rabbitmq-cluster-operator 2.22.4-r0, rabbitmq-messaging-topology-operator 1.18.3-r4, rabbitmq-messaging-topology-operator 1.19.3-r3, rabbitmq-messaging-topology-operator 1.2.1-r1, rclone 1.72.1-r12, rclone 1.73.5-r6, rclone 1.74.4-r1, renovate 44.31.0-r1, renovate 44.32.5-r2, restic 0.18.1-r5, sealed-secrets 0.35.0-r6, sealed-secrets 0.36.6-r4, sealed-secrets 0.37.0.r2, sealed-secrets 0.38.4-r0, stakater-reloader 1.1.0-r4, stakater-reloader 1.2.1-r3, stakater-reloader-fips 1.4.19-r1, step 0.27.5-r4, step 0.28.7-r5, step 0.29.0-r4, step-issuer 0.10.2-r5, step-issuer 0.11.0-r5, step-issuer 0.9.11-r3, tekton-chains-fips 0.24.0-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tekton-pipelines-fips 1.13.1-r2, tekton-pipelines-fips 1.14.0-r4, temporal-server 1.28.4-r2, temporal-server 1.29.7-r1, temporal-server 1.30.5-r1, temporal-server 1.30.6-r3, temporal-ui-server-fips 2.48.4-r1, temporal-ui-server-fips 2.49.1-r1, temporal-ui-server-fips 2.50.1-r1, terraform 1.15.7-r0, tigera-operator 1.42.1-r3, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1, tkn 0.46.0-r1, trino 480-r10, trust-manager 0.21.1-r2, trust-manager 0.22.1-r3, trust-manager 0.23.0-r1, trust-manager 0.24.0-r1, vault 1.19.5-r3, vault 1.20.4-r9, vault 1.21.4-r10, vault 2.0.4-r3, vault-k8s 1.5.0.r3, vault-k8s 1.6.2-r2, vault-k8s 1.7.6-r0, velero 1.15.2-r7, velero 1.17.2-r8, velero 1.18.2-r7, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r4, velero-plugin-for-aws 1.14.2-r1, velero-plugin-for-csi 0.4.3-r5, velero-plugin-for-csi 0.5.1-r4, velero-plugin-for-csi 0.6.3-r3, velero-plugin-for-csi 0.7.1-r5, victoriametrics-operator 0.71.0-r2, victoriametrics-operator-fips 0.69.0-r0, victoriametrics-operator-fips 0.70.1-r0, victoriametrics-operator-fips 0.71.0-r0, wave 0.10.0-r5, wave 0.8.0-r2, wave 0.9.0-r2, wave 011.0-r4, weaviate-fips 1.38.10-r2, weaviate-fips 1.38.11-r2

CVE-2026-33818 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IV50826 Security fix for CVE-2026-56855 applied in: atlantis 0.47.1-r1, boring-registry 0.18.0-r1, cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.19.6-r4, cert-manager 1.20.3-r5, cert-manager 1.21.1-r1, cosign 2.6.5-r3, dex 2.42.1-r4, dex 2.43.1-r3, dex 2.44.0-r8, dex 2.45.1-r7, dynatrace-operator 1.10.2-r1, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, git-lfs 3.7.1-r3, gitea 1.27.2-r2, go-discover 0_git20250325-r4, haproxy-ingress 0.13.19-r4, haproxy-ingress 0.14.12-r5, haproxy-ingress 0.15.4-r7, haproxy-ingress 0.16.1-r7, helm 3.21.4-r2, helm 4.2.4-r2, keda 2.20.2-r2, knative-serving 1.21.3-r4, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, minio-client 0.20250721.052808-r1, minio-operator 6.0.4-r8, minio-operator 7.0.1-r8, minio-operator 7.1.1-r8, nats-streaming 0.25.6-r7, opa 1.20.2-r2, opentelemetry-collector-contrib 0.157.0-r1, prometheus-alertmanager 0.34.0-r2, prometheus-mysqld-exporter 0.17.2-r6, prometheus-mysqld-exporter 0.18.0-r6, prometheus-mysqld-exporter 0.19.0-r5, prometheus-mysqld-exporter 0.20.0-r0, prometheus-node-exporter 1.10.2-r5, prometheus-node-exporter 1.11.1-r4, prometheus-node-exporter 1.12.1-r2, prometheus-node-exporter 1.9.1-r5, prometheus-node-exporter-fips 1.11.1-r3, prometheus-operator 0.90.1-r4, prometheus-operator 0.91.0-r5, prometheus-operator 0.92.1-r3, prometheus-redis-exporter 1.87.0-r2, prometheus-redis-exporter 1.88.0-r3, prometheus-statsd-exporter 0.28.0-r4, prometheus-statsd-exporter 0.29.0-r1, prometheus-statsd-exporter 0.30.0-r0, rclone 1.72.1-r13, rclone 1.73.5-r7, rclone 1.74.4-r2, restic 0.18.1-r8, restic-fips 0.18.1-r7, sealed-secrets 0.36.6-r5, sealed-secrets 0.37.0-r3, sealed-secrets 0.38.4-r1, step 0.27.5-r5, step 0.28.7-r6, step 0.29.0-r5, step-issuer 0.10.2-r6, step-issuer 0.11.0-r6, step-issuer 0.9.11-r4, terraform 1.16.0-r2, tigera-operator 1.42.1-r4, trust-manager 0.21.1-r3, trust-manager 0.22.1-r4, trust-manager 0.23.0-r2, trust-manager 0.24.0-r2, vault 1.19.5-r4, vault 1.20.4-r11, vault 1.21.4-r11, vault 2.0.4-r3, vault-k8s 1.4.2-r3, velero 1.15.2-r9, velero 1.17.2-r9, velero 1.18.2-r8, velero-fips 1.18.2-r7, victoriametrics-operator 0.71.0-r3, victoriametrics-operator 0.73.1-r1, victoriametrics-operator-fips 0.71.0-r1

CVE-2026-56855 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-100427

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101283

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101455

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100622

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100459

Security vulnerability affects the cosign package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

Security update for cosign

This update for cosign rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...

SUSE-SU-2026:3954-1 Security update for cosign

This update for cosign rebuilds it against the current go security release...

PT-2026-90825

This update for cosign rebuilds it against the current go security release...

CLEANSTART-2026-BU98839 Security fixes in cosign 2.6.5-r1

Package cosign version 2.6.5-r1 fixes 3 vulnerabilities: ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

CLEANSTART-2026-AU02418 Security fixes in cosign 2.6.5-r2

Package cosign version 2.6.5-r2 fixes 8 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-OW85965 Security fixes in cosign 3.1.3-r0

Package cosign version 3.1.3-r0 fixes 10 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-HX30295 Security fixes in cosign 2.6.5-r0

Package cosign version 2.6.5-r0 fixes 4 vulnerabilities: CVE-2026-49478, ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

PT-2026-89942

Package cosign version 2.6.5-r1 fixes 3 vulnerabilities: ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...