CLEANSTART-2026-QL99300: NumberInput

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is rated as network-exploitable with low attack complexity. It requires no privileges and no user interaction.

Q: What is the expected security impact?

The reported impact is limited to availability, with high availability impact. No confidentiality or integrity impact is listed.

Q: Which tracked software packages are associated with this issue?

The affected software entries are cleanstart/sonarqube and cleanstart/strimzi-kafka-operator. The advisory states that CVE-2026-89407 affects multiple packages, but provides no version or configuration details.

Published Nov 12, 2026

Updated

CVE-2026-89407 affects multiple packages. NumberInput. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/sonarqube<26.10.0.133078-r0

26.10.0.133078-r0

cleanstart/strimzi-kafka-operator<1.3.0-r0

1.3.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.10.0.133078-r0
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.10.0.133078-r1
Upgrade
Upgrade cleanstart/strimzi-kafka-operator to a version that resolves this vulnerability.
Fixed in 1.3.0-r0

Event History

Nov 12, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-89407

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?