CLEANSTART-2026-NN77774 Security fixes for CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 2.4.0-r0

Multiple security vulnerabilities affect the crossplane-provider-azure package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, gomplate-fips, tfsec, kubescape-server, guac, gomplate, grafana-alloy-fips, amazon-ssm-agent-fips, src-fingerprint, crossplane-fips, pulumi-language-yaml, trufflehog-fips, cerbos-fips, bom, kyverno-fips, argo-events, kaniko-fips, kargo, wolfictl,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, gomplate-fips, tfsec, kubescape-server, guac, gomplate, grafana-alloy-fips, amazon-ssm-agent-fips, src-fingerprint, crossplane-fips, pulumi-language-yaml, trufflehog-fips, cerbos-fips, bom, kyverno-fips, argo-events, kaniko-fips, kargo, wolfictl,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, gomplate-fips, tfsec, kubescape-server, guac, gomplate, grafana-alloy-fips, amazon-ssm-agent-fips, src-fingerprint, crossplane-fips, pulumi-language-yaml, trufflehog-fips, cerbos-fips, bom, kyverno-fips, argo-events, kaniko-fips, kargo, wolfictl,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: nfpm, pulumi-language-dotnet, trivy-operator, argocd-image-updater, bom, trufflehog, zarf, kaniko, kubescape, argo-workflows, chezmoi, gptscript, kots, gitlab-runner, witness, teleport, flux-source-controller, crossplane, dagger, pulumi-kubernetes-operator, trivy,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: nfpm, pulumi-language-dotnet, trivy-operator, argocd-image-updater, bom, trufflehog, zarf, kaniko, kubescape, argo-workflows, chezmoi, gptscript, kots, gitlab-runner, witness, teleport, flux-source-controller, crossplane, dagger, pulumi-kubernetes-operator, trivy,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: nfpm, pulumi-language-dotnet, trivy-operator, argocd-image-updater, bom, trufflehog, zarf, kaniko, kubescape, argo-workflows, chezmoi, gptscript, kots, gitlab-runner, witness, teleport, flux-source-controller, crossplane, dagger, pulumi-kubernetes-operator, trivy,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: nfpm, pulumi-language-dotnet, trivy-operator, argocd-image-updater, bom, trufflehog, zarf, kaniko, kubescape, argo-workflows, chezmoi, gptscript, kots, gitlab-runner, witness, teleport, flux-source-controller, crossplane, dagger, pulumi-kubernetes-operator, trivy,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: tempo, crossplane-provider-aws-rds, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-cloudfront, crossplane-provider-aws-cloudformation, amazon-cloudwatch-agent, crossplane-provider-aws-iam, crossplane-provider-aws-route53,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: tempo, crossplane-provider-aws-rds, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-cloudfront, crossplane-provider-aws-cloudformation, amazon-cloudwatch-agent, crossplane-provider-aws-iam, crossplane-provider-aws-route53,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, crossplane-provider-aws-sns, crossplane-provider-gcp, crossplane-provider-azure-authorization, grafana-alloy-fips, crossplane-provider-aws-route53, datadog-agent, crossplane-provider-azure-storage,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, crossplane-provider-aws-sns, crossplane-provider-gcp, crossplane-provider-azure-authorization, grafana-alloy-fips, crossplane-provider-aws-route53, datadog-agent, crossplane-provider-azure-storage,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, logstash, tetragon-fips, crossplane-provider-gcp, fulcio-fips, kong-ingress-controller-fips, plugin-barman-cloud, neuvector-sigstore-interface, cluster-autoscaler, helm-diff, spiffe-helper-fips,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, logstash, prometheus-nats-exporter-fips, secretgen-controller-fips, tetragon-fips, crossplane-provider-gcp, fulcio-fips, kong-ingress-controller-fips, plugin-barman-cloud, sigstore-scaffolding,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: zarf, crossplane-provider-aws-cloudwatchlogs, kubescape, ratify, sops, witness, crossplane-provider-azure-authorization, crossplane-provider-aws-sqs, cert-manager-cmctl, pulumi-kubernetes-operator, crossplane-provider-aws-sns, ksops, guac, terraform-provider-pagerdut...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: zarf, crossplane-provider-aws-cloudwatchlogs, kubescape, ratify, sops, witness, crossplane-provider-azure-authorization, crossplane-provider-aws-sqs, cert-manager-cmctl, pulumi-kubernetes-operator, crossplane-provider-aws-sns, ksops, guac, terraform-provider-pagerdut...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, crossplane-provider-aws-iam-fips, crossplane-provider-aws-sns, gomplate-fips, terraform-provider-pagerduty-fips, opentofu-fips, tfsec, kubescape-server, guac, crossplane-provider-azure-authorization, gomplate, grafana-alloy-fips,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, crossplane-provider-aws-iam-fips, crossplane-provider-aws-sns, gomplate-fips, terraform-provider-pagerduty-fips, opentofu-fips, tfsec, kubescape-server, guac, crossplane-provider-azure-authorization, gomplate, grafana-alloy-fips,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, mariadb-operator, terragrunt, tailscale, dbmate, temporal, trufflehog, hydra, spire-server, step-ca, ratify, argo-workflows, caddy, step-kms-plugin, dex, rekor, spicedb, timestamp-authority, chezmoi, kots, sops, step, witness, k3s, openbao,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: vault-secrets-webhook, kubernetes-ingress-defaultbackend, datadog-operator, aws-flb-cloudwatch, gcsfuse, speedtest-go, spqr, newrelic-nri-kube-events, fuse-overlayfs-snapshotter, pulumi-kubernetes-operator, metrics-agent, crossplane-provider-aws-sns, ksops,...