CLEANSTART-2026-OM43168

See a problem?

Import Source

https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OM43168.json

JSON Data

https://api.osv.dev/v1/vulns/CLEANSTART-2026-OM43168

Upstream

CVE-2025-68121

Published

2026-11-11T00:38:38Z

Modified

2026-11-11T01:00:27Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Details

Security vulnerability affects the argo-workflows package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.

References

Affected packages

CleanStart / argo-workflows

Package

Name: argo-workflows
Purl: pkg:apk/cleanstart/argo-workflows

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.1.6-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OM43168.json"