Vulnerabilities

TI-2026-77001 CVE-2026-113709

Argo CD Kustomize Helm config lets repository files run commands

MEDIUM 43

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0053 Published 2026-10-20 Fixed in 3.3.15, 3.4.10 +2 CWE-829

TI-2026-77000 CVE-2026-113708

Argument injection in Argo CD Kustomize remote refs can run commands

MEDIUM 44

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00666 Published 2026-10-20 Fixed in 3.3.15, 3.4.10 +2 CWE-88

TI-2026-76990 CVE-2026-113672

Path traversal in Argo CD Jsonnet importer exposes repo-server files

MEDIUM 44

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00837 Published 2026-10-20 Fixed in 3.3.1, 3.4.10 +2 CWE-22

TI-2026-71916 CVE-2026-77459 · GHSA-fmxq-cgp8-87wp

Argo CD delete hooks bypass AppProject resource restrictions

MEDIUM 43

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00498 Published 2026-10-13 Fixed in 3.3.15, 3.4.10 +2 CWE-863

TI-2026-70041 CVE-2026-55797 · GHSA-j6cw-g6p4-7hch

Command injection in Argo CD repo-server via SSH repository proxy URL

MEDIUM 44

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01869 Published 2026-10-09 Partial fix · 3.3.15, 3.4.10 +2 CWE-78

TI-2026-63250 CVE-2026-93991 · GHSA-3fwg-9p8x-37mv

Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

LOW 36

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotE…

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00436 Published 2026-09-19 Fixed in 4.1.4 CWE-639

TI-2026-56742 CVE-2026-82277 · GHSA-366v-5xmx-36vh

Argo Rollouts Dashboard Unauthenticated Mutating Operations

MEDIUM 49

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00779 Published 2026-08-28 Partial fix CWE-306

TI-2026-39371 CVE-2026-54526 · GHSA-48p8-g2fx-3wwm

Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

HIGH 74

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.9 Network Low privileges No interaction EPSS 0.00553 Published 2026-07-16 Fixed in 3.7.15, 4.0.6 CWE-284

TI-2026-33474 CVE-2026-45737 · GHSA-rg3g-4rw9-gqrp

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

MEDIUM 62

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00521 Published 2026-07-15 Fixed in 3.2.12, 3.3.10 +1 CWE-200

TI-2026-33475 CVE-2026-45738 · GHSA-h98r-wv3h-fr38

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

HIGH 73

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00606 Published 2026-07-15 Fixed in 3.2.12, 3.3.10 +1 CWE-79

TI-2026-12972 CVE-2026-15416

Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

LOW 39

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution.

CVSS 3.1HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.00466 Published 2026-07-14 Partial fix · 10.0.0, 1785149260 +1 CWE-306

TI-2026-44408 CVE-2026-62185 · GHSA-25jf-qr89-v245

Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

MEDIUM 40

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs.

CVSS 4.0HIGH 8.6 Adjacent network Low privileges No interaction EPSS 0.0046 Published 2026-07-13 Fixed in 10.0.0 CWE-1188

TI-2026-30605 CVE-2026-42296 · GHSA-3775-99mw-8rp4

Incorrect authorization in argoproj argo-workflows

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-05-09 Fixed in 3.7.14, 4.0.5 CWE-863

TI-2026-30604 CVE-2026-42295 · GHSA-7vf8-2cr6-54mf

Argo Workflows: Exposure of artifact repository credentials

HIGH 72

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00357 Published 2026-05-09 Partial fix · 4.0.5 CWE-522

TI-2026-30603 CVE-2026-42294 · GHSA-jcc8-g2q4-9fxq

Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

HIGH 75

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00599 Published 2026-05-09 Fixed in 3.7.14, 4.0.5 CWE-770

TI-2026-30505 CVE-2026-42183 · GHSA-p4gq-3vxj-f4jq

Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

LOW 12

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00377 Published 2026-05-09 Partial fix · 4.0.5 CWE-476

TI-2026-30606 CVE-2026-42297 · GHSA-xchc-cqwg-g76q

Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00515 Published 2026-05-09 Fixed in 4.0.5 CWE-862

TI-2026-31086 CVE-2026-42880 · GHSA-3v3m-wc6v-x4x3

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

HIGH 76

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00645 Published 2026-05-07 Partial fix · 3.2.11, 3.3.9 CWE-200

TI-2026-31913 CVE-2026-43824 · GHSA-c7mp-5hg2-gfh8

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

HIGH 67

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00268 Published 2026-05-02 Partial fix · 3.2.11, 3.3.9 CWE-212

TI-2026-29542 CVE-2026-40886 · GHSA-5jv8-h7qh-rf5p

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

HIGH 67

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00377 Published 2026-04-23 Fixed in 4.0.5, 3.7.14 CWE-129

TI-2026-24444 CVE-2026-31892 · GHSA-3wf5-g532-rcrr

WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

HIGH 74

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.9 Network Low privileges No interaction EPSS 0.00554 Published 2026-03-11 Fixed in 4.0.2, 3.7.11 CWE-863

TI-2026-22564 CVE-2026-28229 · GHSA-56px-hm34-xqj5

Argo Workflows has unauthorized access to Argo Workflows Template

HIGH 82

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00725 Published 2026-03-11 Fixed in 4.0.2, 3.7.11 CWE-863

TI-2026-19302 CVE-2026-23960 · GHSA-cv78-6m8q-ph82

Argo Workflows affected by stored XSS in the artifact directory listing

LOW 34

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00414 Published 2026-01-21 Partial fix · 3.6.17, 3.7.8 CWE-79

TI-2025-41020 CVE-2025-66626 · GHSA-xrqc-7xgx-c9vh

argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0068 Published 2025-12-09 Fixed in 3.7.5, 3.6.14 CWE-23

TI-2025-38479 CVE-2025-62157 · GHSA-c2hv-4pfj-mm2r

Argo Workflows exposes artifact repository credentials in workflow-controller logs

LOW 37

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00466 Published 2025-10-14 Partial fix · 3.7.3, 3.6.12 CWE-522

Vulnerabilities

Filters