Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Argo Workflows and related tools may run malicious code
published 5 days ago
Summary
Several cleanstart packages, including Argo Workflows, Wazero, Stakater Reloader FIPS, K8sGPT and its operator, contain a weakness that could allow an attacker to make them execute unintended commands. If exploited, this could lead to unauthorized actions on your systems or data. Apply the latest updates or patches from the vendors as soon as they are available.
What to do
- Update cleanstart argo-workflows to version 3.6.19-r2.
- Update cleanstart wazero to version 1.11.0-r0.
- Update cleanstart stakater-reloader-fips to version 1.1.0-r3.
- Update cleanstart k8sgpt to version 0.1.8-r3.
- Update cleanstart k8sgpt-operator to version 0.2.27-r2.
- Update cleanstart volume-modifier-for-k8s-fips to version 0.9.5-r2.
- Update cleanstart argo-events to version 1.6.3-r1.
- Update cleanstart local-static-provisioner-fips to version 2.8.0-r2.
- Update cleanstart volume-modifier-for-k8s to version 0.9.5-r2.
- Update cleanstart multus-cni-fips to version 4.3.0-r1.
- Update cleanstart kubernetes-csi-livenessprobe-fips to version 2.17.0-r0.
- Update cleanstart kyverno-policy-reporter-kyverno-plugin-fips to version 1.6.4-r3.
- Update cleanstart gostatsd to version 28.3.0-r1.
- Update cleanstart percona-xtradb-cluster-operator-fips to version 1.18.0-r3.
- Update cleanstart terragrunt-fips to version 0.95.1-r0.
- Update cleanstart minio-operator-fips to version 7.1.1-r8.
- Update cleanstart minio-operator-fips to version 5.0.18-r7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | argo-workflows |
< 3.6.19-r2 Fix: upgrade to 3.6.19-r2
|
| CleanStart | cleanstart | wazero |
< 1.11.0-r0 Fix: upgrade to 1.11.0-r0
|
| CleanStart | cleanstart | stakater-reloader-fips |
< 1.1.0-r3 Fix: upgrade to 1.1.0-r3
|
| CleanStart | cleanstart | k8sgpt |
< 0.1.8-r3 Fix: upgrade to 0.1.8-r3
|
| CleanStart | cleanstart | k8sgpt-operator |
< 0.2.27-r2 Fix: upgrade to 0.2.27-r2
|
| CleanStart | cleanstart | volume-modifier-for-k8s-fips |
< 0.9.5-r2 Fix: upgrade to 0.9.5-r2
|
| CleanStart | cleanstart | argo-events |
< 1.6.3-r1 Fix: upgrade to 1.6.3-r1
|
| CleanStart | cleanstart | local-static-provisioner-fips |
< 2.8.0-r2 Fix: upgrade to 2.8.0-r2
|
| CleanStart | cleanstart | volume-modifier-for-k8s |
< 0.9.5-r2 Fix: upgrade to 0.9.5-r2
|
| CleanStart | cleanstart | multus-cni-fips |
< 4.3.0-r1 Fix: upgrade to 4.3.0-r1
|
| CleanStart | cleanstart | kubernetes-csi-livenessprobe-fips |
< 2.17.0-r0 Fix: upgrade to 2.17.0-r0
|
| CleanStart | cleanstart | kyverno-policy-reporter-kyverno-plugin-fips |
< 1.6.4-r3 Fix: upgrade to 1.6.4-r3
|
| CleanStart | cleanstart | gostatsd |
< 28.3.0-r1 Fix: upgrade to 28.3.0-r1
|
| CleanStart | cleanstart | percona-xtradb-cluster-operator-fips |
< 1.18.0-r3 Fix: upgrade to 1.18.0-r3
|
| CleanStart | cleanstart | terragrunt-fips |
< 0.95.1-r0 Fix: upgrade to 0.95.1-r0
|
| CleanStart | cleanstart | minio-operator-fips |
< 7.1.1-r8 < 5.0.18-r7 Fix: upgrade to 7.1.1-r8
|
Original advisory text
url
CVE-2026-25679 affects multiple packages. url. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-UH65899 · OSV
Track software like this
Free during beta