CLEANSTART-2026-PB94569: Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Q: Which deployments should be prioritized for investigation?

Investigate environments using cleanstart/kubernetes or cleanstart/argo-workflows, particularly where attack-controlled input can reach processing that handles unescaped '/' characters.

Q: What does an attacker need to exploit this issue?

The vector is network-accessible and requires no privileges, but user interaction is required. Exploitation involves supplying pathological input that closes an unescaped '/' early and causes attack-controlled content to be injected.

Q: What is the potential impact if exploitation succeeds?

The issue can lead to cross-site scripting, with the stated CVSS vector indicating potential low-impact confidentiality and integrity effects and no availability impact.

Published Nov 11, 2026

Updated

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-56858

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Investigate environments using cleanstart/kubernetes or cleanstart/argo-workflows, particularly where attack-controlled input can reach processing that handles unescaped '/' characters.

What does an attacker need to exploit this issue?

The vector is network-accessible and requires no privileges, but user interaction is required. Exploitation involves supplying pathological input that closes an unescaped '/' early and causes attack-controlled content to be injected.

What is the potential impact if exploitation succeeds?

The issue can lead to cross-site scripting, with the stated CVSS vector indicating potential low-impact confidentiality and integrity effects and no availability impact.

CLEANSTART-2026-PB94569: Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for investigation?

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for investigation?

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?