CLEANSTART-2026-BS55103: various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms

Q: What inputs are relevant to exploiting this issue?

The issue is triggered when the package evaluates IPv4-mapped IPv6 addresses with methods such as IsPrivate or IsLoopback. These addresses can be classified differently from their equivalent traditional IPv4 forms.

Q: What security decisions could be affected?

Any workflow or integration that relies on these address-classification methods to identify private, loopback, or similar restricted IPv4 addresses may make an incorrect decision for IPv4-mapped IPv6 input. The affected methods return false where the corresponding traditional IPv4 address would return true.

Q: How can I check whether my deployment may be exposed?

Review uses of argo-workflows address validation or filtering that call IsPrivate, IsLoopback, or related Is methods. Test those paths with IPv4-mapped IPv6 representations of IPv4 addresses that your controls would normally classify as private or loopback.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-24790

Frequently Asked Questions

What inputs are relevant to exploiting this issue?

The issue is triggered when the package evaluates IPv4-mapped IPv6 addresses with methods such as IsPrivate or IsLoopback. These addresses can be classified differently from their equivalent traditional IPv4 forms.

What security decisions could be affected?

Any workflow or integration that relies on these address-classification methods to identify private, loopback, or similar restricted IPv4 addresses may make an incorrect decision for IPv4-mapped IPv6 input. The affected methods return false where the corresponding traditional IPv4 address would return true.

How can I check whether my deployment may be exposed?

Review uses of argo-workflows address validation or filtering that call IsPrivate, IsLoopback, or related Is methods. Test those paths with IPv4-mapped IPv6 representations of IPv4 addresses that your controls would normally classify as private or loopback.

CLEANSTART-2026-BS55103: various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What inputs are relevant to exploiting this issue?

What security decisions could be affected?

How can I check whether my deployment may be exposed?

Company

Resources

Contact

Frequently Asked Questions

What inputs are relevant to exploiting this issue?

What security decisions could be affected?

How can I check whether my deployment may be exposed?