Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
cert-manager and related tools may mishandle "yield" keyword
published 9 days ago
Summary
A template created by a trusted author could contain the word "yield" that is not properly handled in cert-manager, argo-cd, dex, opa-fips, and the snapshotter tool. This can cause the system to treat part of the template as code, potentially leading to unexpected behavior or data exposure. Apply the latest security updates from the vendors and review existing templates for unsafe "yield" usage.
What to do
- Update cleanstart cert-manager to version 1.18.6-r8.
- Update cleanstart argo-cd to version 3.3.16-r1.
- Update cleanstart argo-cd to version 3.4.11-r1.
- Update cleanstart dex to version 2.43.1-r8.
- Update cleanstart opa-fips to version 1.21.2-r2.
- Update cleanstart kubernetes-csi-external-snapshotter to version 8.7.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | cert-manager |
< 1.18.6-r8 Fix: upgrade to 1.18.6-r8
|
| CleanStart | cleanstart | argo-cd |
< 3.3.16-r1 < 3.4.11-r1 Fix: upgrade to 3.3.16-r1
|
| CleanStart | cleanstart | dex |
< 2.43.1-r8 Fix: upgrade to 2.43.1-r8
|
| CleanStart | cleanstart | opa-fips |
< 1.21.2-r2 Fix: upgrade to 1.21.2-r2
|
| CleanStart | cleanstart | kubernetes-csi-external-snapshotter |
< 8.7.0-r0 Fix: upgrade to 8.7.0-r0
|
Original advisory text
trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped
CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CLEANSTART-2026-AP50040 · OSV
Track software like this
Free during beta