CLEANSTART-2026-XJ31485: ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Q: Which deployments should be prioritized for investigation?

Deployments using either cleanstart/kubernetes or cleanstart/argo-workflows should be investigated, as both are listed as affected software. The available data does not identify specific affected versions or configurations.

Q: What level of attacker access is required?

The vector indicates network reachability, low attack complexity, and low privileges required. No user interaction is required.

Q: What is the potential impact if exploited?

The severity vector indicates high confidentiality and integrity impact, with scope changed. Availability impact is listed as none.

Published Nov 11, 2026

Updated

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-39821

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Deployments using either cleanstart/kubernetes or cleanstart/argo-workflows should be investigated, as both are listed as affected software. The available data does not identify specific affected versions or configurations.

What level of attacker access is required?

The vector indicates network reachability, low attack complexity, and low privileges required. No user interaction is required.

What is the potential impact if exploited?

The severity vector indicates high confidentiality and integrity impact, with scope changed. Availability impact is listed as none.

CLEANSTART-2026-XJ31485: ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for investigation?

What level of attacker access is required?

What is the potential impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for investigation?

What level of attacker access is required?

What is the potential impact if exploited?