CLEANSTART-2026-KQ06811: trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

Q: Which deployments are identified as affected?

The affected software listed is cleanstart/kubernetes and cleanstart/argo-workflows. The data does not provide affected or fixed version ranges.

Q: What must be present for exploitation to be relevant?

A trusted template author must previously have created a valid template that uses the 'yield' keyword and in which that use was not correctly escaped. The provided data does not describe a separate attacker authentication requirement.

Q: Are all templates necessarily affected?

No. The issue is described as applying to templates with a previously written valid use of 'yield' that was not correctly escaped.

Q: How can teams determine whether they may be affected?

Review existing templates in the listed software for use of the 'yield' keyword, particularly templates authored before this issue was identified, and determine whether those occurrences are correctly escaped.

Published Nov 11, 2026

Updated

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97030

Frequently Asked Questions

Which deployments are identified as affected?

The affected software listed is cleanstart/kubernetes and cleanstart/argo-workflows. The data does not provide affected or fixed version ranges.

What must be present for exploitation to be relevant?

A trusted template author must previously have created a valid template that uses the 'yield' keyword and in which that use was not correctly escaped. The provided data does not describe a separate attacker authentication requirement.

Are all templates necessarily affected?

No. The issue is described as applying to templates with a previously written valid use of 'yield' that was not correctly escaped.

How can teams determine whether they may be affected?

Review existing templates in the listed software for use of the 'yield' keyword, particularly templates authored before this issue was identified, and determine whether those occurrences are correctly escaped.

CLEANSTART-2026-KQ06811: trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are identified as affected?

What must be present for exploitation to be relevant?

Are all templates necessarily affected?

How can teams determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are identified as affected?

What must be present for exploitation to be relevant?

Are all templates necessarily affected?

How can teams determine whether they may be affected?