CLEANSTART-2026-UJ51572: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

Q: Does exploitation require authentication or user interaction?

The severity vector indicates that no privileges or user interaction are required. It is rated as network-accessible with low attack complexity.

Q: What is the documented security impact?

The vulnerability is rated high severity with a 7.5 score. The stated impact is high availability impact, with no confidentiality or integrity impact.

Q: Which software is identified as affected?

The affected software is identified as cleanstart/argo-workflows. No affected or fixed version information is provided.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Affected Software

2 affected componentsFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2

Event History

Nov 11, 2026

Advisory Published

via OSV·12:41 AM

Data Sourced

via OSV·12:41 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-27903

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The severity vector indicates that no privileges or user interaction are required. It is rated as network-accessible with low attack complexity.

What is the documented security impact?

The vulnerability is rated high severity with a 7.5 score. The stated impact is high availability impact, with no confidentiality or integrity impact.

Which software is identified as affected?

The affected software is identified as cleanstart/argo-workflows. No affected or fixed version information is provided.

CLEANSTART-2026-UJ51572: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the documented security impact?

Which software is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the documented security impact?

Which software is identified as affected?