Read the docs
TI-2024-36055 Aliases CVE-2024-53862GHSA-h36c-m3rf-34h9

Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode

Priority HIGH 67CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-290.

Summary

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}` or when using `--auth-mode=sso`, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`. No authentication is performed by the Server itself on `client` tokens. Authentication & authorization is instead delegated to the k8s API server. However, the Workflow Archive does not interact with k8s, and so any token that looks valid will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does the equivalent of a `kubectl auth can-i` check for respective methods. In 3.5.7 and 3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on these lines, allowing archived workflows to be retrieved with a fake token. This vulnerability is fixed in 3.6.2 and 3.5.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed argo-workflows (argoproj): 3.5.13, 3.6.2github.com/argoproj/argo-workflows/v3 (Go): 3.5.13, 3.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-workflows3.5.7 to before 3.5.13; 3.6.0-rc1 to before 3.6.23.5.13, 3.6.2Patch availableCNA
—github.com/argoproj/argo-workflows/v3 (Go)3.5.7 to before 3.5.133.5.13Patch availableGHSA-h36c-m3rf-34h9
—github.com/argoproj/argo-workflows/v3 (Go)3.6.0 to before 3.6.23.6.2Patch availableGHSA-h36c-m3rf-34h9
  • argo-workflows Vendorargoproj Affected 3.5.7 to before 3.5.13; 3.6.0-rc1 to before 3.6.2 Fixed in 3.5.13, 3.6.2 Patch available CNA
  • github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected 3.5.7 to before 3.5.13 Fixed in 3.5.13 Patch available GHSA-h36c-m3rf-34h9
  • github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected 3.6.0 to before 3.6.2 Fixed in 3.6.2 Patch available GHSA-h36c-m3rf-34h9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*3.5.7 to before 3.5.13; 3.6.0 to before 3.6.2Vulnerableargoproj
  • cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* Versions 3.5.7 to before 3.5.13; 3.6.0 to before 3.6.2 Vulnerable ·argoproj

Remediation

  • Fix · CNA argo-workflows (argoproj) Fixed in 3.5.13, 3.6.2
  • Fix · GHSA-h36c-m3rf-34h9 github.com/argoproj/argo-workflows/v3 (Go) Fixed in 3.5.13 Advisory →
  • Fix · GHSA-h36c-m3rf-34h9 github.com/argoproj/argo-workflows/v3 (Go) Fixed in 3.6.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-53862
  2. 2026-10-03 Alias added: GHSA-h36c-m3rf-34h9
  3. 2026-10-05 EPSS moved to the below the 50th percentile
  4. 2026-10-08 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-22564 Argo Workflows has unauthorized access to Argo Workflows Template CVSS 3.1CRITICAL 9.8
  • TI-2026-30603 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVSS 4.0HIGH 8.2
  • TI-2026-39371 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing CVSS 4.0HIGH 8.9
  • TI-2026-24444 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode CVSS 4.0HIGH 8.9
  • TI-2026-30604 Argo Workflows: Exposure of artifact repository credentials CVSS 4.0HIGH 8.5
  • TI-2025-38478 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences