Read the docs
TI-2021-15674 Aliases CVE-2021-37914GHSA-h563-xh25-x54q

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users…

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.

Why it matters now

EPSS 0.00963 61st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed github.com/argoproj/argo-workflows/v3 (Go): 3.1.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/argoproj/argo-workflows/v3 (Go)3.1.0 to before 3.1.63.1.6Patch availableGHSA-h563-xh25-x54q
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected 3.1.0 to before 3.1.6 Fixed in 3.1.6 Patch available GHSA-h563-xh25-x54q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*up to 3.1.3Vulnerableargoproj
  • cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* Versions up to 3.1.3 Vulnerable ·argoproj

Remediation

  • Fix · GHSA-h563-xh25-x54q github.com/argoproj/argo-workflows/v3 (Go) Fixed in 3.1.6 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37914
  2. 2026-10-03 Alias added: GHSA-h563-xh25-x54q

References

Exploit 2

Advisory 1

Other 3

  • TI-2026-22564 Argo Workflows has unauthorized access to Argo Workflows Template CVSS 3.1CRITICAL 9.8
  • TI-2026-30603 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVSS 4.0HIGH 8.2
  • TI-2026-39371 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing CVSS 4.0HIGH 8.9
  • TI-2026-24444 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode CVSS 4.0HIGH 8.9
  • TI-2026-30604 Argo Workflows: Exposure of artifact repository credentials CVSS 4.0HIGH 8.5
  • TI-2025-38478 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences