CLEANSTART-2026-BB17877 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 0.87.1-r0, 0.89.0-r0

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BP32212 Security fixes for CVE-2025-61727, CVE-2025-61729, CVE-2025-61732, CVE-2025-68121, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 0.87.0-r0, 0.87.0-r1, 0.88.0-r0

Multiple security vulnerabilities affect the prometheus-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RD09851 net/url package does not set a limit on the number of query parameters in a query

Multiple security vulnerabilities affect the prometheus-operator package. The net/url package does not set a limit on the number of query parameters in a query. See references for individual vulnerability details...

CLEANSTART-2026-TR92727 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Multiple security vulnerabilities affect the prometheus-operator-fips package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should ha...

CLEANSTART-2026-IA26094 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the prometheus-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-DO68350 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the prometheus-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-PH90623 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the prometheus-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-XO66167 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the prometheus-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-UU20906 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the prometheus-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CVE-2024-45336 vulnerabilities

Vulnerabilities for packages: ini-file, aws-ebs-csi-driver, sftpgo-plugin-eventstore, temporal-server, openbao-fips, kuberay-operator-fips, argo-events, confluent-common-docker, crossplane-provider-aws, postgres-operator, kserve-modelmesh-serving, kubernetes-csi-driver-hostpath, cosign-fips,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: k8sgpt, rekor, spire-server, trivy, wal-g, chezmoi, hugo, velero, grafana-mimir, zarf, zot, secrets-store-csi-driver-provider-azure, policy-controller, falcoctl, argo-workflows, fluent-bit-plugin-loki, flux-image-reflector-controller, terragrunt, bank-vaults,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, confluent-common-docker, crossplane-provider-aws, postgres-operator, rabbitmq-default-user-credential-updater, kubernetes-csi-driver-hostpath, cosign-fips, kubernetes-dashboard-metrics-scraper, protoc-gen-go, sops, trivy-fips, dex, dockerize-fips,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, temporal-server, crossplane-provider-aws, kubernetes-csi-driver-hostpath, cosign-fips, kubernetes-dashboard-metrics-scraper, sops, dex, terraform-provider-sendgrid, crossplane-provider-gcp, rabbitmq-cluster-operator, fuse-overlayfs-snapshotter,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, stakater-reloader, prometheus-alertmanager, aws-flb-firehose, rqlite, tflint, aws-flb-cloudwatch, nri-couchbase, aws-flb-kinesis, mongo-tools, temporal-server, pulumi, nri-apache, shfmt, newrelic-infrastructure-agent, gcsfuse,...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator

Summary Multiple issues were identified in Red Hat UBI packages systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator that were shipped with IBM MQ Operator and IBM supplied MQ Advanced container images. IBM has addressed the vulnerabilities. Vulnerability Details...