CLEANSTART-2026-NS11400: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Q: Which deployments should be prioritized for review?

Review deployments using cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows, as these are the software packages identified as affected.

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates network reachability is sufficient, with low attack complexity. It does not require privileges or user interaction.

Q: What is the expected security impact?

The supplied CVSS vector indicates a high availability impact. It indicates no confidentiality or integrity impact.

Published Nov 11, 2026

Updated

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details.

Affected Software

5 affected componentsFixes available

cleanstart/gitea<1.26.4-r6

1.26.4-r6

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r0

1.34.13-r0

cleanstart/kyverno<1.19.2-r1

1.19.2-r1

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.26.4-r6
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78659

Frequently Asked Questions

Which deployments should be prioritized for review?

Review deployments using cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows, as these are the software packages identified as affected.

What does an attacker need to exploit this issue?

The CVSS vector indicates network reachability is sufficient, with low attack complexity. It does not require privileges or user interaction.

What is the expected security impact?

The supplied CVSS vector indicates a high availability impact. It indicates no confidentiality or integrity impact.

CLEANSTART-2026-NS11400: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for review?

What does an attacker need to exploit this issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

What does an attacker need to exploit this issue?

What is the expected security impact?