| Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)CVE-2026-54526 · GHSA-48P8-G2FX-3WWMVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorCVE-2026-42294 · GHSA-JCC8-G2Q4-9FXQVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Argo has Missing Authorization in its Sync ConfigMap ProviderCVE-2026-42297 · GHSA-XCHC-CQWG-G76QVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)CVE-2026-42183 · GHSA-P4GQ-3VXJ-F4JQVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
GoRed Hat |
Low
|
Fix reported |
|
| Argo vulnerable to exposure of artifact repository credentialsCVE-2026-42295 · GHSA-7VF8-2CR6-54MFVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
GoRed Hat |
High
|
Fix reported |
|
| Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows ControllerCVE-2026-40886 · GHSA-5JV8-H7QH-RF5PVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/SecureCVE-2026-42296 · GHSA-3775-99MW-8RP4Version ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Unauthorized access to Argo Workflows TemplateCVE-2026-28229 · GHSA-56PX-HM34-XQJ5Version ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference ModeCVE-2026-31892 · GHSA-3WF5-G532-RCRRVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Argo Workflows Controller: Denial of Service via malicious daemon WorkflowsCVE-2024-47827 · GHSA-GHJW-32XW-FFWRVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
Medium
|
Fix reported |
|
| Argo Server TLS requests could be forged by attacker with network accessGHSA-6C73-2V8X-QPVM · GO-2022-0388Version ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
Medium
|
Fix reported |
|
| Workflow re-write vulnerability using input parameterCVE-2021-37914 · GHSA-H563-XH25-X54QVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
Medium
|
Fix reported |
|
| Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`GHSA-PRQF-XR2J-XF65 · GO-2022-0405Version ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
Low
|
Fix reported |
|
| Argo Workflow may expose artifact repository credentialsCVE-2025-62157 · GHSA-C2HV-4PFJ-MM2RVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
GoRed Hat |
High
|
Fix reported |
|
| Argo Workflows affected by stored XSS in the artifact directory listingCVE-2026-23960 · GHSA-CV78-6M8Q-PH82Version ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
GoRed Hat |
High
|
Fix reported |
|
| RCE via ZipSlip and symbolic links in argoproj/argo-workflowsCVE-2025-66626 · GHSA-XRQC-7XGX-C9VHVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
High
|
Fix reported |
|
| Access to Archived Argo Workflows with Fake Token in `client` modeCVE-2024-53862 · GHSA-H36C-M3RF-34H9Version ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
Go |
Medium
|
Fix reported |
|
| Argo Workflow has a Zipslip VulnerabilityCVE-2025-62156 · GHSA-P84V-GXVW-73PFVersion ranges need review. |
github.com/argoproj/argo-workflows/v2github.com/argoproj/argo-workflows/v3 |
GoRed Hat |
High
|
Fix reported |
|
