CLEANSTART-2026-PF25900: Werkzeug is a comprehensive WSGI web application library

Q: Which deployments should be prioritized for review?

Review deployments using cleanstart/apache-superset or cleanstart/airflow-3, as these are the affected software entries in this record.

Q: What does the available exploit information indicate about attacker access?

The vector indicates network reachability, low attack complexity, and no required privileges or user interaction. It also indicates that additional attack conditions are required, but this record does not specify what those conditions are.

Q: What impact is identified in the available assessment?

The assessment identifies low availability impact. It identifies no confidentiality or integrity impact, and no impact on subsequent systems.

Q: Can affected versions, default exposure, or an interim mitigation be determined from this record?

No. The record does not provide affected or fixed versions, default-configuration status, detection guidance, or a workaround; the referenced individual vulnerability details would need to be reviewed.

Published Nov 3, 2026

Updated

CVE-2026-102598 affects multiple packages. Werkzeug is a comprehensive WSGI web application library. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/apache-superset<2021.36.5-r0

2021.36.5-r0

cleanstart/airflow-3<3.3.2-r1

3.3.2-r1

Event History

Nov 3, 2026

Advisory Published

via OSV·12:42 AM

Data Sourced

via OSV·12:42 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-102598

Frequently Asked Questions

Which deployments should be prioritized for review?

Review deployments using cleanstart/apache-superset or cleanstart/airflow-3, as these are the affected software entries in this record.

What does the available exploit information indicate about attacker access?

The vector indicates network reachability, low attack complexity, and no required privileges or user interaction. It also indicates that additional attack conditions are required, but this record does not specify what those conditions are.

What impact is identified in the available assessment?

The assessment identifies low availability impact. It identifies no confidentiality or integrity impact, and no impact on subsequent systems.

Can affected versions, default exposure, or an interim mitigation be determined from this record?

No. The record does not provide affected or fixed versions, default-configuration status, detection guidance, or a workaround; the referenced individual vulnerability details would need to be reviewed.

CLEANSTART-2026-PF25900: Werkzeug is a comprehensive WSGI web application library

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for review?

What does the available exploit information indicate about attacker access?

What impact is identified in the available assessment?

Can affected versions, default exposure, or an interim mitigation be determined from this record?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

What does the available exploit information indicate about attacker access?

What impact is identified in the available assessment?

Can affected versions, default exposure, or an interim mitigation be determined from this record?