CLEANSTART-2026-NG84104: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

Q: Which deployments are identified as affected?

The affected software list includes cleanstart/knative-net-istio, cleanstart/knative-serving, cleanstart/velero, cleanstart/external-dns, cleanstart/gitea, cleanstart/kubernetes, cleanstart/traefik, and cleanstart/kyverno.

Q: What does an attacker need to exploit this issue?

The supplied vector indicates network access is sufficient and no privileges are required, but user interaction is required. The attack complexity is rated low.

Q: What is the expected security impact?

The issue can cause low confidentiality and low integrity impact, with no availability impact indicated. Its scope is marked as changed.

Published Nov 11, 2026

Updated

CVE-2026-97045 affects multiple packages. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. See references for individual vulnerability details.

Affected Software

21 affected componentsFixes available

cleanstart/external-dns<0.20.0-r5

0.20.0-r5

cleanstart/gitea<1.26.4-r6

1.26.4-r6

cleanstart/velero<1.17.2-r13

1.17.2-r13

cleanstart/kubernetes<1.34.13-r0

1.34.13-r0

cleanstart/gitea<1.27.3-r2

1.27.3-r2

cleanstart/knative-net-istio<1.21.4-r8

1.21.4-r8

cleanstart/traefik<3.4.5-r7

3.4.5-r7

cleanstart/knative-net-istio<1.22.1-r7

1.22.1-r7

cleanstart/knative-net-istio<1.23.0-r7

1.23.0-r7

cleanstart/knative-serving<1.22.1-r11

1.22.1-r11

cleanstart/knative-serving<1.23.0-r5

1.23.0-r5

cleanstart/knative-serving<1.21.3-r8

1.21.3-r8

cleanstart/knative-net-istio<1.24.0-r1

1.24.0-r1

cleanstart/knative-serving<1.24.0-r1

1.24.0-r1

cleanstart/kyverno<1.19.2-r2

1.19.2-r2

cleanstart/external-dns<0.22.0-r5

0.22.0-r5

cleanstart/velero<1.16.2-r17

1.16.2-r17

cleanstart/velero<1.15.2-r13

1.15.2-r13

cleanstart/opentelemetry-collector-contrib<0.163.0-r1

0.163.0-r1

cleanstart/rundeck<6.1.0-r3

6.1.0-r3

cleanstart/argo-workflows<4.0.15-r1

4.0.15-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/external-dns to a version that resolves this vulnerability.
Fixed in 0.20.0-r5
Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.26.4-r6
Upgrade
Upgrade cleanstart/velero to a version that resolves this vulnerability.
Fixed in 1.17.2-r13
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.27.3-r2
Upgrade
Upgrade cleanstart/knative-net-istio to a version that resolves this vulnerability.
Fixed in 1.21.4-r8
Upgrade
Upgrade cleanstart/traefik to a version that resolves this vulnerability.
Fixed in 3.4.5-r7
Upgrade
Upgrade cleanstart/knative-net-istio to a version that resolves this vulnerability.
Fixed in 1.22.1-r7
Upgrade
Upgrade cleanstart/knative-net-istio to a version that resolves this vulnerability.
Fixed in 1.23.0-r7
Upgrade
Upgrade cleanstart/knative-serving to a version that resolves this vulnerability.
Fixed in 1.22.1-r11
Upgrade
Upgrade cleanstart/knative-serving to a version that resolves this vulnerability.
Fixed in 1.23.0-r5
Upgrade
Upgrade cleanstart/knative-serving to a version that resolves this vulnerability.
Fixed in 1.21.3-r8
Upgrade
Upgrade cleanstart/knative-net-istio to a version that resolves this vulnerability.
Fixed in 1.24.0-r1
Upgrade
Upgrade cleanstart/knative-serving to a version that resolves this vulnerability.
Fixed in 1.24.0-r1
Upgrade
Upgrade cleanstart/kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2-r2
Upgrade
Upgrade cleanstart/external-dns to a version that resolves this vulnerability.
Fixed in 0.22.0-r5
Upgrade
Upgrade cleanstart/velero to a version that resolves this vulnerability.
Fixed in 1.16.2-r17
Upgrade
Upgrade cleanstart/velero to a version that resolves this vulnerability.
Fixed in 1.15.2-r13
Upgrade
Upgrade cleanstart/opentelemetry-collector-contrib to a version that resolves this vulnerability.
Fixed in 0.163.0-r1
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r3
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:41 AM

Data Sourced

via OSV·12:41 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97045

Frequently Asked Questions

Which deployments are identified as affected?

The affected software list includes cleanstart/knative-net-istio, cleanstart/knative-serving, cleanstart/velero, cleanstart/external-dns, cleanstart/gitea, cleanstart/kubernetes, cleanstart/traefik, and cleanstart/kyverno.

What does an attacker need to exploit this issue?

The supplied vector indicates network access is sufficient and no privileges are required, but user interaction is required. The attack complexity is rated low.

What is the expected security impact?

The issue can cause low confidentiality and low integrity impact, with no availability impact indicated. Its scope is marked as changed.

CLEANSTART-2026-NG84104: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are identified as affected?

What does an attacker need to exploit this issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are identified as affected?

What does an attacker need to exploit this issue?

What is the expected security impact?