CLEANSTART-2026-QU22546: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)

Q: What level of access does an attacker need?

The vulnerability is network-reachable and does not require prior privileges or user interaction. Exploitation is rated as having high attack complexity.

Q: What security impact could successful exploitation have?

Successful exploitation can have high impact on confidentiality and integrity for the vulnerable component. It can also have high confidentiality and integrity impact on affected components beyond the vulnerable component; availability impact is not indicated.

Q: Is exploitation known to require a particular configuration?

No configuration prerequisite is identified in the available data. The vulnerability is identified in the form-data dependency used by the cleanstart/argo-workflows package.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).

Affected Software

2 affected componentsFixes available

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-7783

Frequently Asked Questions

What level of access does an attacker need?

The vulnerability is network-reachable and does not require prior privileges or user interaction. Exploitation is rated as having high attack complexity.

What security impact could successful exploitation have?

Successful exploitation can have high impact on confidentiality and integrity for the vulnerable component. It can also have high confidentiality and integrity impact on affected components beyond the vulnerable component; availability impact is not indicated.

Is exploitation known to require a particular configuration?

No configuration prerequisite is identified in the available data. The vulnerability is identified in the form-data dependency used by the cleanstart/argo-workflows package.

CLEANSTART-2026-QU22546: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need?

What security impact could successful exploitation have?

Is exploitation known to require a particular configuration?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What security impact could successful exploitation have?

Is exploitation known to require a particular configuration?