CLEANSTART-2026-FB28308: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information

Q: Which deployments are exposed to sensitive-information leakage?

Deployments using argo-workflows where Proxy-Authorization or Proxy-Authenticate headers may be sent during a cross-origin redirect are potentially exposed. The issue concerns persistence of those proxy-related headers across the redirect.

Q: What condition is required for exploitation?

The affected request flow must involve a cross-origin redirect. The available information does not identify affected versions, default configuration status, or a workaround if patching is unavailable.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-4673

Frequently Asked Questions

Which deployments are exposed to sensitive-information leakage?

Deployments using argo-workflows where Proxy-Authorization or Proxy-Authenticate headers may be sent during a cross-origin redirect are potentially exposed. The issue concerns persistence of those proxy-related headers across the redirect.

What condition is required for exploitation?

The affected request flow must involve a cross-origin redirect. The available information does not identify affected versions, default configuration status, or a workaround if patching is unavailable.

CLEANSTART-2026-FB28308: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to sensitive-information leakage?

What condition is required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to sensitive-information leakage?

What condition is required for exploitation?