CLEANSTART-2026-FF30727: Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture

Q: Which deployments are exposed to this issue?

The issue affects the argo-workflows package when it is running on the ppc64le architecture. The provided information does not identify exposure on other architectures.

Q: What does an attacker need to exploit the issue?

The supplied severity vector indicates local access is required, with low attack complexity and no privileges or user interaction required. The issue leaks a small number of bits from secret scalars through variable-time assembly behavior.

Q: What is the expected impact?

The provided vector indicates a low confidentiality impact and no integrity or availability impact. The disclosed behavior is limited to leakage of a small number of secret-scalar bits.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-22866

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects the argo-workflows package when it is running on the ppc64le architecture. The provided information does not identify exposure on other architectures.

What does an attacker need to exploit the issue?

The supplied severity vector indicates local access is required, with low attack complexity and no privileges or user interaction required. The issue leaks a small number of bits from secret scalars through variable-time assembly behavior.

What is the expected impact?

The provided vector indicates a low confidentiality impact and no integrity or availability impact. The disclosed behavior is limited to leakage of a small number of secret-scalar bits.

CLEANSTART-2026-FF30727: Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

What is the expected impact?