CLEANSTART-2026-MC29038 Security fix for GHSA-hrxh-6v49-42gf applied in: temporal-server 1.30.8-r1, grafana-fips 13.1.0-r1, temporal-server-fips 1.31.4-r1, istio-pilot-discovery 1.29.8-r1, istio-pilot-discovery 1.30.1-r1, openbao 2.6.1-r0, external-dns 0.20.0-r3, kube-state-metrics 2.20.0-r4

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YS81054 Security fix for GHSA-259r-337f-4rfw applied in: temporal-server 1.30.8-r2, temporal-server-fips 1.31.4-r2, argo-rollouts 1.10.0-r1, stakater-reloader 1.2.1-r5, istio-pilot-discovery 1.29.8-r1, istio-pilot-discovery 1.30.1-r1, stakater-reloader 1.1.0-r9, stakater-reloader 1.3.0-r9, openbao 2.6.1-r0, nfs-subdir-external-provisioner 4.0.18-r4, mongodb 8.2.12-r4

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EH09681 Security fix for GHSA-gcjh-h69q-9w9g applied in: grafana-fips 13.1.0-r1, istio-pilot-discovery 1.29.8-r1, istio-pilot-discovery 1.30.1-r1, openbao 2.6.1-r1

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HE89623 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.18.0-r3, kube-state-metrics-fips 2.19.1-r1, istio-pilot-discovery 1.31.1-r0

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZG24378 Security fix for CVE-2025-61727 applied in: apache-nifi 2.10.0-r4, aws-flb-firehose 1.7.2-r0, aws-flb-kinesis 1.10.3-r0, calico-fips 3.31.2-r1, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cloudnative-pg-fips 1.24.4-r0, cloudnative-pg-fips 1.25.4-r0, cloudnative-pg-fips 1.26.2-r0, cni-plugin-flannel 1.6.0-r0, cni-plugins-fips 1.8.0-r0, configmap-reload 0.15.0-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.6-r0, consul-k8s-fips 1.9.1-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, docker-fips 28.4.0-r0, druid-exporter-fips 0.10-r1, druid-exporter-fips 0.11-r2, eck-operator 3.2.0-r1, eks-distro-kube-apiserver-fips 1.34.2-r0, elastic-beats-fips 9.2.2-r0, external-dns 0.18.0-r0, external-dns-fips 0.20.0-r0, external-secrets 0.20.4-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.25 1.25.6-r1, gomplate-fips 4.3.3-r3, harbor-registry 3.0.0.1-r2, harbor-registry-fips 2.6.2-r0, harbor-registry-fips 2.7.1-r0, harbor-registry-fips 2.8.3-r0, harbor-registry-fips 3.0.0-r1, helm-fips 3.17-4-r0, helm-fips 3.19.0-r1, helm-fips 4.0.1-r0, helm-operator-fips 1.39.0-r1, helm-operator-fips 1.41.1-r1, ip-masq-agent 2.12.6-r1, istio-operator-fips 1.25.5-r0, istio-operator-fips 1.26.7-r0, istio-operator-fips 1.27.4-r0, istio-operator-fips 1.28.1-r0, istio-operator-fips 1.4.10-r6, istio-pilot-discovery 1.28.1-r0, istio-pilot-discovery-fips 1.25.5-r0, istio-pilot-discovery-fips 1.26.7-r0, istio-pilot-discovery-fips 1.27.4-r0, istio-pilot-discovery-fips 1.28.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, k8ssandra-operator-fips 1.26.0-r0, k8ssandra-operator-fips 1.27.0-r0, k8ssandra-operator-fips 1.28.0-r0, k8ssandra-operator-fips 1.29.0-r0, kaniko-fips 1.24.0-r0, kapp-controller 0.59.0-r1, kapp-controller-fips 0.59.0-r1, kube-rbac-proxy-fips 0.17.1-r1, kube-rbac-proxy-fips 0.18.2-r2, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kube-state-metrics-fips 2.17.0-r0, kubernetes 1.31.14-r1, kubernetes 1.32-10-r1, kubernetes 1.33.6-r0, kubernetes 1.34.2-r0, kubernetes-csi-external-resizer-fips 2.0.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-csi-node-driver-registrar-fips 2.15.0-r0, kubernetes-fips 1.31.14-r0, kubernetes-fips 1.32.10-r0, kubernetes-fips 1.32.2-r0, kubernetes-fips 1.33.6-r0, kured 1.20.0-r0, metallb-fips 0.14.9-r1, metrics-server 0.8.0-r0, metrics-server-fips 0.5.2-r1, metrics-server-fips 0.6.4-r1, metrics-server-fips 0.7.2-r3, metrics-server-fips 0.8.0-r5, minio-operator 7.1.1-r3, mongodb 8.2.1-r1, mongodb 8.2.6-r1, multus-cni-fips 4.0.2-r3, multus-cni-fips 4.1.4-r4, multus-cni-fips 4.2.3-r1, nginx-prometheus-exporter 1.5.1-r0, nginx-prometheus-exporter-fips 1.5.1-r0, nvidia-container-toolkit 1.19.0-r0, openbao-fips 2.4.4-r2, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, opentofu-fips 1.10.7-r0, opentofu-fips 1.7.10-r0, opentofu-fips 1.8.11-r0, opentofu-fips 1.9.4-r1, prometheus-fips 3.5.0-r4, prometheus-fips 3.9.0-r0, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r0, prometheus-node-exporter-fips 1.7.0-r1, prometheus-node-exporter-fips 1.8.2-r1, prometheus-node-exporter-fips 1.9.1-r0, prometheus-operator-fips 0.85.0-r1, prometheus-operator-fips 0.86.2-r0, prometheus-operator-fips 0.87.0-r0, prometheus-redis-exporter-fips 1.77.0-r0, prometheus-redis-exporter-fips 1.78.0-r0, prometheus-redis-exporter-fips 1.79.0-r0, promxy 0.0.93-r1, rabbitmq-messaging-topology-operator 1.15.0-r1, restic 0.18.0-r0, runc 1.1.14-r0, smarter-device-manager-fips 1.20.12-r0, spark-operator 2.2.1-r0, spire-server-fips 1.13.3-r0, stakater-reloader-fips 1.1.0-r3, stakater-reloader-fips 1.2.1-r1, stakater-reloader-fips 1.3.0-r0, stakater-reloader-fips 1.4.10-r0, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r2, tekton-pipelines 1.5.0-r0, tekton-pipelines-fips 1.5.0-r0, tempo 2.9.0-r0, terragrunt-fips 0.90.2-r0, terragrunt-fips 0.91.5-r0, terragrunt-fips 0.92.1-r0, terragrunt-fips 0.93.13-r1, thanos-operator-fips 0.3.7-r0, trino 479-r0, velero 1.17.0-r1, velero-fips 1.14.1-r1, velero-fips 1.16.2, vertical-pod-autoscaler 1.5.1-r0, vertical-pod-autoscaler-fips 1.5.1-r0, volume-modifier-for-k8s 0.9.0-r0, volume-modifier-for-k8s-fips 0.9.0-r0, wave-fips 0.10.0-r0, wave-fips 0.9.0-r3

CVE-2025-61727 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GR62343 Security fixes in istio-pilot-discovery 1.28.3-r0

Package istio-pilot-discovery version 1.28.3-r0 fixes 1 vulnerabilities: ghsa-9h8m-3fm2-qjrq...

CLEANSTART-2026-HX84275 Security fixes in istio-pilot-discovery 1.28.1-r0

Package istio-pilot-discovery version 1.28.1-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-CP77103 Security fixes in istio-pilot-discovery-fips 1.26.7-r0

Package istio-pilot-discovery-fips version 1.26.7-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

PT-2026-85891

Package istio-pilot-discovery version 1.28.3-r0 fixes 1 vulnerabilities: ghsa-9h8m-3fm2-qjrq...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the JWKS resolver, which can be exposed if a fetch operation fails. An attacker can obtain private keys by forcing such a failure. Note: The keys are exposed even if RequestAuthentication is in use...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...

CLEANSTART-2026-IM73098 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the istio-pilot-discovery package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-XB34574 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-TF52804 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-BL06950 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-CK72347 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...