CLEANSTART-2026-QK89502 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the vault-k8s package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-KP10631 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the vault-k8s package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for...

CLEANSTART-2026-RE83921 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the vault-k8s package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: opa-envoy, crossplane-provider-aws-rds, db-operator, delve, argocd-image-updater, crossplane-provider-aws-s3, crossplane-provider-aws-kinesis, ksops, crossplane-provider-aws-sns, aws-flb-cloudwatch, amazon-cloudwatch-agent-operator, src-fingerprint,...

GO-2026-5037 vulnerabilities

Vulnerabilities for packages: opa-envoy, crossplane-provider-aws-rds, db-operator, delve, argocd-image-updater, crossplane-provider-aws-s3, crossplane-provider-aws-kinesis, ksops, crossplane-provider-aws-sns, aws-flb-cloudwatch, amazon-cloudwatch-agent-operator, src-fingerprint,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: minio, crossplane-provider-aws-rds, db-operator, sbomqs, crossplane-provider-aws-s3, extism, crossplane-provider-aws-kinesis, ksops, crossplane-provider-aws-sns, wgcf, aws-flb-cloudwatch, amazon-cloudwatch-agent-operator, clickhouse-operator, dockerize,...

CLEANSTART-2026-GS57944 Security fixes in vault-k8s-fips 1.7.5-r1

Package vault-k8s-fips version 1.7.5-r1 fixes 1 vulnerabilities: CVE-2026-39822...

CLEANSTART-2026-FE65207 Security fixes in vault-k8s-fips 1.4.2-r0

Package vault-k8s-fips version 1.4.2-r0 fixes 1 vulnerabilities: ghsa-6v2p-p543-phr9...

CLEANSTART-2026-IC30001 Security fixes in vault-k8s-fips 1.7.0-r0

Package vault-k8s-fips version 1.7.0-r0 fixes 2 vulnerabilities: ghsa-qxp5-gwg8-xv66, ghsa-vvgc-356p-c3xw...

CLEANSTART-2026-BP68746 Security fixes in vault-k8s-fips 1.5.0-r0

Package vault-k8s-fips version 1.5.0-r0 fixes 1 vulnerabilities: ghsa-6v2p-p543-phr9...

CLEANSTART-2026-UY85485 Within HostnameError

Multiple security vulnerabilities affect the vault-k8s package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2025-CN65903 Security fixes for GHSA-6v2p-p543-phr9, GHSA-qxp5-gwg8-xv66, GHSA-vvgc-356p-c3xw applied in versions: 1.5.0-r0, 1.7.0-r0

Multiple security vulnerabilities affect the vault-k8s-fips package. These issues are resolved in later releases. See references for individual GHSA details...

CLEANSTART-2025-EU07511 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729 applied in versions: 1.7.0-r0, 1.7.1-r0

Multiple security vulnerabilities affect the vault-k8s package. These issues are resolved in later releases. See references for individual CVE details...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: blobfuse2, dagdotdev, local-path-provisioner, sftpgo-plugin-geoipfilter, sftpgo-plugin-pubsub, k8sgpt-operator, newrelic-nri-statsd, nats, gitsign, hivemind, kuberay-operator, grafana-operator, confluent-common-docker, vault-benchmark, kube-vip-cloud-provider,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: custom-pod-autoscaler-operator, local-path-provisioner, mattmoor-chainit, kube-vip, terraform-provider-time, apm-server-fips, prometheus-nats-exporter, kube-logging-operator-custom-runner-fips, hivemind, cloud-provider-aws, mongodb-kubernetes-operator,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: custom-pod-autoscaler-operator, local-path-provisioner, mattmoor-chainit, kube-vip, terraform-provider-time, apm-server-fips, prometheus-nats-exporter, kube-logging-operator-custom-runner-fips, hivemind, cloud-provider-aws, mongodb-kubernetes-operator,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: wait-for-port, minio, sbomqs, delve, fq, k8sgpt-operator, k8ssandra-operator, hello-world-golang, aws-flb-cloudwatch, dockerize, src-fingerprint, nfs-subdir-external-provisioner, nri-haproxy, kyverno-policy-reporter-kyverno-plugin, temporal-ui-server, esbuild,...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: minio, crossplane-provider-aws-rds, sbomqs, terraform-provider-tls, nsc, crossplane-provider-aws-s3, extism, fq, crossplane-provider-aws-kinesis, ksops, portieris, terraform-provider-sendgrid, crossplane-provider-aws-sns, wgcf, dockerize,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure, aactl, aws-load-balancer-controller, cosign, dynamic-localpv-provisioner, nri-prometheus, gke-gcloud-auth-plugin, secrets-store-csi-driver-provider-gcp, nfs-subdir-external-provisioner, aws-efs-csi-driver-fips, flux, runc, zot,...