CLEANSTART-2026-ZY17213: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Q: Which CleanStart software entries are associated with this advisory?

The advisory lists cleanstart/tempo and cleanstart/vault. Review deployments of both for their included Go JOSE packages.

Q: Does the advisory provide an exploit prerequisite, affected version range, or temporary mitigation?

No. The available data does not specify affected versions, exploitation prerequisites, default-configuration impact, or a workaround; it directs readers to the referenced individual vulnerability details.

Published Nov 5, 2026

Updated

CVE-2026-116585 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/tempo<2.10.10-r0

2.10.10-r0

cleanstart/tempo<3.1.1-r1

3.1.1-r1

cleanstart/tempo<3.0.5-r1

3.0.5-r1

cleanstart/vault<2.0.4-r9

2.0.4-r9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/tempo to a version that resolves this vulnerability.
Fixed in 2.10.10-r0
Upgrade
Upgrade cleanstart/tempo to a version that resolves this vulnerability.
Fixed in 3.1.1-r1
Upgrade
Upgrade cleanstart/tempo to a version that resolves this vulnerability.
Fixed in 3.0.5-r1
Upgrade
Upgrade cleanstart/vault to a version that resolves this vulnerability.
Fixed in 2.0.4-r9

Event History

Nov 5, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116585

Frequently Asked Questions

Which CleanStart software entries are associated with this advisory?

The advisory lists cleanstart/tempo and cleanstart/vault. Review deployments of both for their included Go JOSE packages.

Does the advisory provide an exploit prerequisite, affected version range, or temporary mitigation?

No. The available data does not specify affected versions, exploitation prerequisites, default-configuration impact, or a workaround; it directs readers to the referenced individual vulnerability details.

CLEANSTART-2026-ZY17213: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which CleanStart software entries are associated with this advisory?

Does the advisory provide an exploit prerequisite, affected version range, or temporary mitigation?

Company

Resources

Contact

Frequently Asked Questions

Which CleanStart software entries are associated with this advisory?

Does the advisory provide an exploit prerequisite, affected version range, or temporary mitigation?