Argo Workflows
Argoproj · 17 CVEs
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Jul 16, 2026
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateR…
May 9, 2026
Argo Workflows: Exposure of artifact repository credentials
May 9, 2026
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
May 9, 2026
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
May 9, 2026
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
May 9, 2026
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
Apr 23, 2026
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Mar 11, 2026
Argo Workflows has unauthorized access to Argo Workflows Template
Mar 11, 2026
Argo Workflows affected by stored XSS in the artifact directory listing
Jan 21, 2026
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Dec 9, 2025
Argo Workflows exposes artifact repository credentials in workflow-controller logs
Oct 14, 2025
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
Oct 14, 2025
Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode
Dec 2, 2024
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Oct 28, 2024
Privilege Escalation in argo-workflows
May 5, 2022
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input pa…
Aug 2, 2021
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-54526 | Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing | HIGH | 0.55% | Jul 16, 2026 |
| CVE-2026-42296 | Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure | HIGH | 0.49% | May 9, 2026 |
| CVE-2026-42295 | Argo Workflows: Exposure of artifact repository credentials | HIGH | 0.40% | May 9, 2026 |
| CVE-2026-42294 | Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor | HIGH | 0.74% | May 9, 2026 |
| CVE-2026-42183 | Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) | LOW | 0.57% | May 9, 2026 |
| CVE-2026-42297 | Argo Workflows Is Missing Authorization in Sync ConfigMap Provider | HIGH | 0.53% | May 9, 2026 |
| CVE-2026-40886 | Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller | HIGH | 0.59% | Apr 23, 2026 |
| CVE-2026-31892 | WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode | HIGH | 0.65% | Mar 11, 2026 |
| CVE-2026-28229 | Argo Workflows has unauthorized access to Argo Workflows Template | CRITICAL | 0.78% | Mar 11, 2026 |
| CVE-2026-23960 | Argo Workflows affected by stored XSS in the artifact directory listing | HIGH | 0.40% | Jan 21, 2026 |
| CVE-2025-66626 | argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links | HIGH | 0.68% | Dec 9, 2025 |
| CVE-2025-62157 | Argo Workflows exposes artifact repository credentials in workflow-controller logs | HIGH | 0.47% | Oct 14, 2025 |
| CVE-2025-62156 | argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite | HIGH | 0.59% | Oct 14, 2025 |
| CVE-2024-53862 | Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode | MEDIUM | 0.66% | Dec 2, 2024 |
| CVE-2024-47827 | Argo Workflows Controller: Denial of Service via malicious daemon Workflows | MEDIUM | 0.36% | Oct 28, 2024 |
| CVE-2022-29164 | Privilege Escalation in argo-workflows | HIGH | 0.92% | May 5, 2022 |
| CVE-2021-37914 | In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an atta… | MEDIUM | 0.96% | Aug 2, 2021 |
Showing 1 to 17 of 17 CVEs