CLEANSTART-2026-XH23377: On most platforms, Go uses the given system root certificates

Q: Which Cleanstart packages are in scope?

The affected software list includes cleanstart/kubernetes, cleanstart/wait-for-port, cleanstart/haproxy-ingress, cleanstart/opentelemetry-collector-contrib, cleanstart/rundeck, and cleanstart/argo-workflows.

Q: Is this behavior limited to a specific operating system?

The available information says it applies on most platforms. It does not identify which platforms, if any, are excluded.

Q: Does the available information specify affected versions, exploit prerequisites, or mitigations?

No. The provided data does not state affected versions, attacker requirements, default-configuration impact, or workaround steps; the referenced individual vulnerability details would need to be reviewed for that information.

Published Nov 11, 2026

Updated

CVE-2026-111943 affects multiple packages. On most platforms, Go uses the given system root certificates. See references for individual vulnerability details.

Affected Software

7 affected componentsFixes available

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/wait-for-port<1.0.10-r8

1.0.10-r8

cleanstart/haproxy-ingress<0.15.4-r11

0.15.4-r11

cleanstart/opentelemetry-collector-contrib<0.163.0-r1

0.163.0-r1

cleanstart/rundeck<6.1.0-r3

6.1.0-r3

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/wait-for-port to a version that resolves this vulnerability.
Fixed in 1.0.10-r8
Upgrade
Upgrade cleanstart/haproxy-ingress to a version that resolves this vulnerability.
Fixed in 0.15.4-r11
Upgrade
Upgrade cleanstart/opentelemetry-collector-contrib to a version that resolves this vulnerability.
Fixed in 0.163.0-r1
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r3
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111943

Frequently Asked Questions

Which Cleanstart packages are in scope?

The affected software list includes cleanstart/kubernetes, cleanstart/wait-for-port, cleanstart/haproxy-ingress, cleanstart/opentelemetry-collector-contrib, cleanstart/rundeck, and cleanstart/argo-workflows.

Is this behavior limited to a specific operating system?

The available information says it applies on most platforms. It does not identify which platforms, if any, are excluded.

Does the available information specify affected versions, exploit prerequisites, or mitigations?

No. The provided data does not state affected versions, attacker requirements, default-configuration impact, or workaround steps; the referenced individual vulnerability details would need to be reviewed for that information.

CLEANSTART-2026-XH23377: On most platforms, Go uses the given system root certificates

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Cleanstart packages are in scope?

Is this behavior limited to a specific operating system?

Does the available information specify affected versions, exploit prerequisites, or mitigations?

Company

Resources

Contact

Frequently Asked Questions

Which Cleanstart packages are in scope?

Is this behavior limited to a specific operating system?

Does the available information specify affected versions, exploit prerequisites, or mitigations?