Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-285.
Summary
### Impact This is pro-active fix. No know exploits exist. Impacted: * You're running Kubernetes >= v1.19 * You're running Argo Server * It is configured to with `--auth-mode=client` * Is not configured with `--auth-mode=server` * You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM. * You're using client key to authenticate on the server. * The server has more permissions that the connecting client's account. The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account. ### Patches https://github.com/argoproj/argo-workflows/pull/6506 ### Workarounds None.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/argoproj/argo-workflows/v3 (Go) | 3.0.0 to before 3.0.9 | 3.0.9 | Patch available | GHSA-prqf-xr2j-xf65 |
| — | github.com/argoproj/argo-workflows/v3 (Go) | 3.1.0 to before 3.1.6 | 3.1.6 | Patch available | GHSA-prqf-xr2j-xf65 |
- github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected 3.0.0 to before 3.0.9 Fixed in 3.0.9 Patch available GHSA-prqf-xr2j-xf65
- github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected 3.1.0 to before 3.1.6 Fixed in 3.1.6 Patch available GHSA-prqf-xr2j-xf65
Remediation
- Fix · GHSA-prqf-xr2j-xf65 github.com/argoproj/argo-workflows/v3 (Go) Fixed in 3.0.9 Advisory →
- Fix · GHSA-prqf-xr2j-xf65 github.com/argoproj/argo-workflows/v3 (Go) Fixed in 3.1.6 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-prqf-xr2j-xf65
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences