CLEANSTART-2026-II22452 Security fix for GHSA-9h8m-3fm2-qjrq applied in: metrics-server-fips 0.8.1-r3, amazon-cloudwatch-agent 1.300065.0-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, istio-fips 1.28.1-r1

GHSA-9h8m-3fm2-qjrq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AG54423 Security fix for GHSA-p77j-4mvh-x3m3 applied in: helm-fips 3.20.2-r0, dynamic-localpv-provisioner 4.5.0-r1, argo-workflows 3.6.19-r3, fulcio-fips 1.8.7-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, litestream 0.5.14-r1, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, cert-manager 1.19.4-r1

GHSA-p77j-4mvh-x3m3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

AZL-112127 CVE-2026-97045 affecting package prometheus-adapter 0.12.0-12

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

AZL-112124 CVE-2026-78661 affecting package prometheus-adapter 0.12.0-12

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

CVE-2026-78669 affecting package prometheus-adapter for versions less than 0.12.0-12

CVE-2026-78669 affecting package prometheus-adapter for versions less than 0.12.0-12. A patched version of the package is available...

CVE-2026-97032 affecting package prometheus-adapter for versions less than 0.12.0-12

CVE-2026-97032 affecting package prometheus-adapter for versions less than 0.12.0-12. A patched version of the package is available...

CVE-2026-78659 affecting package prometheus-adapter for versions less than 0.12.0-12

CVE-2026-78659 affecting package prometheus-adapter for versions less than 0.12.0-12. A patched version of the package is available...

CVE-2026-78660 affecting package prometheus-adapter for versions less than 0.12.0-12

CVE-2026-78660 affecting package prometheus-adapter for versions less than 0.12.0-12. A patched version of the package is available...

CVE-2026-78663 affecting package prometheus-adapter for versions less than 0.12.0-12

CVE-2026-78663 affecting package prometheus-adapter for versions less than 0.12.0-12. A patched version of the package is available...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: argo-workflows, grafana, kyverno-policy-reporter-ui, headlamp, cert-manager, spire-server, kyverno-policy-reporter, renovate, rancher-agent, flux, step, zarf, kube-arangodb, cert-manager-webhook-pdns, kubernetes, external-dns, filebrowser, loki, cloudprober,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: argo-workflows, grafana, kyverno-policy-reporter-ui, headlamp, cert-manager, spire-server, kyverno-policy-reporter, renovate, rancher-agent, flux, step, zarf, kube-arangodb, cert-manager-webhook-pdns, kubernetes, external-dns, filebrowser, loki, cloudprober,...

CVE-2026-83530 affecting package prometheus-adapter for versions less than 0.12.0-11

CVE-2026-83530 affecting package prometheus-adapter for versions less than 0.12.0-11. A patched version of the package is available...

CVE-2026-84445 affecting package prometheus-adapter for versions less than 0.12.0-11

CVE-2026-84445 affecting package prometheus-adapter for versions less than 0.12.0-11. A patched version of the package is available...

AZL-107811 CVE-2026-97032 affecting package prometheus-adapter for versions less than 0.12.0-12

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107808 CVE-2026-78669 affecting package prometheus-adapter for versions less than 0.12.0-12

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107814 CVE-2026-78663 affecting package prometheus-adapter for versions less than 0.12.0-12

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107820 CVE-2026-78660 affecting package prometheus-adapter for versions less than 0.12.0-12

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107817 CVE-2026-78659 affecting package prometheus-adapter for versions less than 0.12.0-12

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

GO-2026-6505 vulnerabilities

Vulnerabilities for packages: knative-eventing, kubescape-operator, dbmate, cert-manager-istio-csr, kubevela, pgtimetable, trivy, cluster-api, hydra, sftpgo, k8sgateway, cluster-autoscaler, lazydocker, cadvisor, tekton-pipelines, rancher-agent, temporal, gatekeeper, keda, kube-arangodb,...

CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10

CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10. A patched version of the package is available...