CLEANSTART-2026-ML51704: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

Q: What access does an attacker need to exploit this issue?

The reported vector requires local access and low privileges. No user interaction is required.

Q: What is the expected security impact?

The severity data indicates low confidentiality and availability impact, with no integrity impact reported. The scope is unchanged.

Q: Which deployments should be assessed?

Deployments using the cleanstart/argo-workflows package should assess host matching against proxy patterns, because the issue involves IPv6 zone IDs being treated as hostname components. The provided data does not identify affected versions or specific configuration conditions.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-22870

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The reported vector requires local access and low privileges. No user interaction is required.

What is the expected security impact?

The severity data indicates low confidentiality and availability impact, with no integrity impact reported. The scope is unchanged.

Which deployments should be assessed?

Deployments using the cleanstart/argo-workflows package should assess host matching against proxy patterns, because the issue involves IPv6 zone IDs being treated as hostname components. The provided data does not identify affected versions or specific configuration conditions.

CLEANSTART-2026-ML51704: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?

Which deployments should be assessed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?

Which deployments should be assessed?