Vulnerabilities

TI-2026-39371 CVE-2026-54526 · GHSA-48p8-g2fx-3wwm

Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

HIGH 74

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.9 Network Low privileges No interaction EPSS 0.00553 Published 2026-07-16 Fixed in 3.7.15, 4.0.6 CWE-284

TI-2026-30605 CVE-2026-42296 · GHSA-3775-99mw-8rp4

Incorrect authorization in argoproj argo-workflows

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-05-09 Fixed in 3.7.14, 4.0.5 CWE-863

TI-2026-30604 CVE-2026-42295 · GHSA-7vf8-2cr6-54mf

Argo Workflows: Exposure of artifact repository credentials

HIGH 72

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00357 Published 2026-05-09 Partial fix · 4.0.5 CWE-522

TI-2026-30603 CVE-2026-42294 · GHSA-jcc8-g2q4-9fxq

Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

HIGH 75

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00599 Published 2026-05-09 Fixed in 3.7.14, 4.0.5 CWE-770

TI-2026-30505 CVE-2026-42183 · GHSA-p4gq-3vxj-f4jq

Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

LOW 12

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00377 Published 2026-05-09 Partial fix · 4.0.5 CWE-476

TI-2026-30606 CVE-2026-42297 · GHSA-xchc-cqwg-g76q

Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00515 Published 2026-05-09 Fixed in 4.0.5 CWE-862

TI-2026-29542 CVE-2026-40886 · GHSA-5jv8-h7qh-rf5p

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

HIGH 67

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00377 Published 2026-04-23 Fixed in 4.0.5, 3.7.14 CWE-129

TI-2026-24444 CVE-2026-31892 · GHSA-3wf5-g532-rcrr

WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

HIGH 74

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.9 Network Low privileges No interaction EPSS 0.00554 Published 2026-03-11 Fixed in 4.0.2, 3.7.11 CWE-863

TI-2026-22564 CVE-2026-28229 · GHSA-56px-hm34-xqj5

Argo Workflows has unauthorized access to Argo Workflows Template

HIGH 82

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00725 Published 2026-03-11 Fixed in 4.0.2, 3.7.11 CWE-863

TI-2026-19302 CVE-2026-23960 · GHSA-cv78-6m8q-ph82

Argo Workflows affected by stored XSS in the artifact directory listing

LOW 34

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00414 Published 2026-01-21 Partial fix · 3.6.17, 3.7.8 CWE-79

TI-2025-41020 CVE-2025-66626 · GHSA-xrqc-7xgx-c9vh

argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0068 Published 2025-12-09 Fixed in 3.7.5, 3.6.14 CWE-23

TI-2025-38479 CVE-2025-62157 · GHSA-c2hv-4pfj-mm2r

Argo Workflows exposes artifact repository credentials in workflow-controller logs

LOW 37

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00466 Published 2025-10-14 Partial fix · 3.7.3, 3.6.12 CWE-522

TI-2025-38478 CVE-2025-62156 · GHSA-p84v-gxvw-73pf

argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite

HIGH 71

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00605 Published 2025-10-14 Partial fix · 3.6.12, 3.7.3 CWE-22

TI-2024-36055 CVE-2024-53862 · GHSA-h36c-m3rf-34h9

Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode

HIGH 67

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0066 Published 2024-12-02 Fixed in 3.5.13, 3.6.2 CWE-200

TI-2024-32094 CVE-2024-47827 · GHSA-ghjw-32xw-ffwr

Argo Workflows Controller: Denial of Service via malicious daemon Workflows

MEDIUM 59

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.0036 Published 2024-10-28 Fixed in 3.6.0-rc2 CWE-1108

TI-2022-11708 CVE-2022-29164 · GHSA-cmv8-6362-r5w9

Privilege Escalation in argo-workflows

LOW 35

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00921 Published 2022-05-05 Fixed in 3.2.11, 3.3.5 CWE-269

TI-2021-15674 CVE-2021-37914 · GHSA-h563-xh25-x54q

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users…

LOW 31

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression tem…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00963 Published 2021-08-02 Fixed in 3.1.6 CWE-20

Vulnerabilities

Filters