CLEANSTART-2026-WX98709: Previously, resolving relative paths containing parent directory ('

Q: Which deployments should be prioritized for triage?

Prioritize environments using cleanstart/kubernetes or cleanstart/argo-workflows. The advisory states that CVE-2026-56860 affects multiple packages, but it does not identify affected versions or configurations.

Q: Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges are required and no user interaction is required. The attack vector is network-based, although exploitation has high attack complexity.

Q: What is the indicated security impact?

The CVSS vector indicates a high availability impact, with no confidentiality or integrity impact indicated. The listed severity is medium, with a score of 5.9.

Published Nov 11, 2026

Updated

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory ('. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-56860

Frequently Asked Questions

Which deployments should be prioritized for triage?

Prioritize environments using cleanstart/kubernetes or cleanstart/argo-workflows. The advisory states that CVE-2026-56860 affects multiple packages, but it does not identify affected versions or configurations.

Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges are required and no user interaction is required. The attack vector is network-based, although exploitation has high attack complexity.

What is the indicated security impact?

The CVSS vector indicates a high availability impact, with no confidentiality or integrity impact indicated. The listed severity is medium, with a score of 5.9.

CLEANSTART-2026-WX98709: Previously, resolving relative paths containing parent directory ('

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for triage?

Does exploitation require authentication or user interaction?

What is the indicated security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for triage?

Does exploitation require authentication or user interaction?

What is the indicated security impact?