CLEANSTART-2026-QT07597: Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Q: What level of attacker access is required?

The severity vector indicates network access is sufficient, with low attack complexity. No privileges or user interaction are required.

Q: What is the expected security impact?

The reported impact is high on integrity. Confidentiality and availability impacts are listed as none, and the scope is unchanged.

Q: Which deployments should be included in triage?

Review deployments using cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows. The provided data does not identify affected versions or configurations.

Published Nov 11, 2026

Updated

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details.

Affected Software

5 affected componentsFixes available

cleanstart/gitea<1.26.4-r6

1.26.4-r6

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r0

1.34.13-r0

cleanstart/kyverno<1.19.2-r1

1.19.2-r1

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.26.4-r6
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78660

Frequently Asked Questions

What level of attacker access is required?

The severity vector indicates network access is sufficient, with low attack complexity. No privileges or user interaction are required.

What is the expected security impact?

The reported impact is high on integrity. Confidentiality and availability impacts are listed as none, and the scope is unchanged.

Which deployments should be included in triage?

Review deployments using cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows. The provided data does not identify affected versions or configurations.

CLEANSTART-2026-QT07597: Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of attacker access is required?

What is the expected security impact?

Which deployments should be included in triage?

Company

Resources

Contact

Frequently Asked Questions

What level of attacker access is required?

What is the expected security impact?

Which deployments should be included in triage?