CLEANSTART-2025-OY40600 Security fix for GHSA-h8cp-697h-8c8p applied in: step-issuer-fips 0.9.9-r1

Security vulnerability affects the step-issuer-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UQ43773 Security fix for GHSA-rjr7-jggh-pgcp applied in: step-issuer 0.10.2-r3, cosign 2.6.4-r2

GHSA-rjr7-jggh-pgcp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZS81320 Security fix for GHSA-9g5q-2w5x-hmxf applied in: step-issuer 0.10.2-r3, cosign 2.6.4-r2

GHSA-9g5q-2w5x-hmxf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KU00621 Security fix for GHSA-3fxj-6jh8-hvhx applied in: step-issuer 0.10.2-r3, cosign 2.6.4-r2

GHSA-3fxj-6jh8-hvhx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GHSA-8RVJ-MM4H-C258 vulnerabilities

Vulnerabilities for packages: cert-manager-google-cas-issuer, athenz-cert-manager-issuer-fips, redpanda-operator, gitlab-operator-fips, cert-manager-csi-driver-fips, cert-manager-istio-csr-fips, cert-manager-cmctl-fips, cert-manager-webhook-pdns-fips, kuberay-operator-fips,...

GHSA-8RVJ-MM4H-C258 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-csi-driver, mariadb-operator, cert-manager-webhook-pdns, cert-manager-istio-csr, aws-privateca-issuer, step-issuer, kuberay-operator, percona-server-mongodb-operator...

CLEANSTART-2026-OJ05849 Security fix for GHSA-259r-337f-4rfw applied in: loki 3.7.1-r2, keda 2.20.2-r0, knative-serving 1.21.3-r0, velero 1.16.2-r15, velero 1.16.2-r8, prometheus 3.5.3-r12, prometheus 3.5.3-r8, temporal-server 1.30.6-r1, temporal-server 1.30.6-r2, temporal-server 1.30.8-r1, temporal-server-fips 1.31.4-r1, mongodb 8.1.3-r2, weaviate-fips 1.36.23-r2, kubernetes-event-exporter 1.4-r0, rancher-fleet-agent 0.13.16-r1, thanos 0.40.1-r3, thanos 0.41.0-r2, prometheus 3.5.3-r9, thanos 0.39.2-r4, cadvisor 0.55.1-r3, step-issuer 0.10.2-r3

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: buf, dapr-fips, tkn, dapr, caddy-fips, caddy, rclone, telegraf, cloudflared, sftpgo, step-ca, karma, kyverno-policy-reporter-ui-fips, step-issuer-fips, kyverno-policy-reporter-ui, tkn-fips, gogatekeeper, step, step-issuer, rclone-fips, step-fips, step-ca-fips, gitnes...

CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: step-ca, karma, caddy, gogatekeeper, step, step-issuer, buf, rclone, tkn, cloudflared, kyverno-policy-reporter-ui, gitness, sftpgo...

GHSA-XCVF-46F4-XWXF vulnerabilities

Vulnerabilities for packages: step-ca, karma, caddy, gogatekeeper, step, step-issuer, buf, rclone, tkn, cloudflared, kyverno-policy-reporter-ui, gitness, sftpgo...

CLEANSTART-2025-CI91808 Security fix for GHSA-j7c9-79x7-8hpm applied in: step-issuer-fips 0.9.9-r1

Security vulnerability affects the step-issuer-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RS62088 Security fix for GHSA-j7c9-79x7-8hpr applied in: step-cli 0.27.5-r0, step-issuer-fips 0.9.9-r3

GHSA-j7c9-79x7-8hpr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MK81849 Security fix for CVE-2025-66406 applied in: step 0.28.7-r2, step-cli 0.27.5-r1, step-issuer-fips 0.9.11-r1

CVE-2025-66406 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZR04706 Security fix for CVE-2025-44005 applied in: step-cli 0.27.5-r1, step-issuer-fips 0.9.11-r1

CVE-2025-44005 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JI14170 Security fix for GHSA-q4r8-xm5f-56gw applied in: step-cli 0.27.5-r0, step-issuer 0.10.0-r0, step-issuer 0.10.1-r0

GHSA-q4r8-xm5f-56gw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TM64574 Security fix for CVE-2026-30836 applied in: step 0.28.7-r3, step 0.29.0-r2, step-cli 0.27.5-r1, step-issuer 0.10.0-r0, step-issuer 0.10.1-r0, step-issuer 0.10.2-r0, step-issuer 0.9.11-r1

CVE-2026-30836 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OJ21892 Security fix for CVE-2026-25518 applied in: cert-manager-cmctl-fips 2.4.0-r2, percona-xtradb-cluster-operator 1.18.0-r1, percona-xtradb-cluster-operator-fips 1.18.0-r1, step-issuer 0.9.11-r1

CVE-2026-25518 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-99990

Security vulnerability affects the step-issuer-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EG40747 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the step-issuer package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-QK25151 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the step-issuer package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...