CLEANSTART-2026-DP22487: ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Q: What conditions make an argo-workflows deployment exposed to this issue?

Exposure requires use of the affected ReverseProxy behavior where Rewrite functions are expected to inspect or control query parameters. Requests can be forwarded with query parameters that are not visible to those Rewrite functions.

Q: What access does an attacker need?

The supplied vector indicates that exploitation is network-accessible and requires no privileges or user interaction. The data does not identify any additional deployment-specific prerequisites.

Q: What is the expected impact if exploited?

The supplied severity vector indicates low confidentiality impact, with no integrity or availability impact. The vulnerability can allow hidden query parameters to bypass assumptions made by Rewrite functions.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-39825

Frequently Asked Questions

What conditions make an argo-workflows deployment exposed to this issue?

Exposure requires use of the affected ReverseProxy behavior where Rewrite functions are expected to inspect or control query parameters. Requests can be forwarded with query parameters that are not visible to those Rewrite functions.

What access does an attacker need?

The supplied vector indicates that exploitation is network-accessible and requires no privileges or user interaction. The data does not identify any additional deployment-specific prerequisites.

What is the expected impact if exploited?

The supplied severity vector indicates low confidentiality impact, with no integrity or availability impact. The vulnerability can allow hidden query parameters to bypass assumptions made by Rewrite functions.

CLEANSTART-2026-DP22487: ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions make an argo-workflows deployment exposed to this issue?

What access does an attacker need?

What is the expected impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

What conditions make an argo-workflows deployment exposed to this issue?

What access does an attacker need?

What is the expected impact if exploited?