CLEANSTART-2026-QW65619: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Q: Does exploitation require an active attacker or authenticated access?

No. The issue can be observed passively on the network and does not require privileges or user interaction.

Q: Which connections are exposed to de-anonymization?

Connections using Encrypted Client Hello are affected when pre-shared key identities are disclosed in the unencrypted Client Hello. A passive network observer may use that disclosure to de-anonymize those handshakes.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-42505

Frequently Asked Questions

Does exploitation require an active attacker or authenticated access?

No. The issue can be observed passively on the network and does not require privileges or user interaction.

Which connections are exposed to de-anonymization?

Connections using Encrypted Client Hello are affected when pre-shared key identities are disclosed in the unencrypted Client Hello. A passive network observer may use that disclosure to de-anonymize those handshakes.

CLEANSTART-2026-QW65619: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require an active attacker or authenticated access?

Which connections are exposed to de-anonymization?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an active attacker or authenticated access?

Which connections are exposed to de-anonymization?