CLEANSTART-2026-OM43168: During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Q: What conditions are required for exploitation?

An attacker must be able to use TLS session resumption after an initial handshake and before or after the underlying TLS Config's ClientCAs or RootCAs fields are changed. The issue occurs when the resumed handshake relies on stale trust-validation state and succeeds even though a new handshake should fail.

Q: Are deployments using unchanged TLS trust settings affected?

The described condition specifically requires mutation of the underlying Config's ClientCAs or RootCAs fields between the initial and resumed handshakes. The provided data does not indicate impact when those fields are not changed.

Q: What can be done if a fix cannot be applied immediately?

Avoid mutating ClientCAs or RootCAs on an in-use TLS Config between initial and resumed handshakes. Ensure trust-store changes are handled in a way that does not allow existing resumable sessions to be accepted under outdated CA settings.

Q: How can an organization determine whether it may be affected?

Review whether argo-workflows uses TLS session resumption and whether its TLS Config has ClientCAs or RootCAs modified at runtime. Test whether a session established before a CA configuration change can resume successfully after the change when a fresh handshake would be rejected.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-68121

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to use TLS session resumption after an initial handshake and before or after the underlying TLS Config's ClientCAs or RootCAs fields are changed. The issue occurs when the resumed handshake relies on stale trust-validation state and succeeds even though a new handshake should fail.

Are deployments using unchanged TLS trust settings affected?

The described condition specifically requires mutation of the underlying Config's ClientCAs or RootCAs fields between the initial and resumed handshakes. The provided data does not indicate impact when those fields are not changed.

What can be done if a fix cannot be applied immediately?

Avoid mutating ClientCAs or RootCAs on an in-use TLS Config between initial and resumed handshakes. Ensure trust-store changes are handled in a way that does not allow existing resumable sessions to be accepted under outdated CA settings.

How can an organization determine whether it may be affected?

Review whether argo-workflows uses TLS session resumption and whether its TLS Config has ClientCAs or RootCAs modified at runtime. Test whether a session established before a CA configuration change can resume successfully after the change when a fresh handshake would be rejected.

CLEANSTART-2026-OM43168: During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

Are deployments using unchanged TLS trust settings affected?

What can be done if a fix cannot be applied immediately?

How can an organization determine whether it may be affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Are deployments using unchanged TLS trust settings affected?

What can be done if a fix cannot be applied immediately?

How can an organization determine whether it may be affected?