CVE-2025-32445

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor...

CVE-2025-32445 Users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor...

CVE-2025-32445 Users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor...

CVE-2025-32445 Users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor...

Argo Events 安全漏洞

Argo Events is an event-driven workflow automation framework for Kubernetes open-sourced by Argo Project. A security vulnerability exists in versions prior to Argo Events v1.9.6 that stems from a user with the permission to create or modify EventSource and Sensor can gain privileged access to the...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining through the spec.template.container configuration in the EventSource and Sensor custom resources. An attacker can gain privileged access to the host system and cluster by injecting commands into a container template...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining through the spec.template.container configuration in the EventSource and Sensor custom resources. An attacker can gain privileged access to the host system and cluster by injecting commands into a container template...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining through the spec.template.container configuration in the EventSource and Sensor custom resources. An attacker can gain privileged access to the host system and cluster by injecting commands into a container template...

PT-2025-16385

Name of the Vulnerable Software and Affected Versions Argo Events versions prior to 1.9.6 Description Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create or modify EventSource and Sensor custom resources can gain privileged access to the...

GHSA-QXP5-GWG8-XV66 vulnerabilities

Vulnerabilities for packages: kube-vip, terraform-provider-time, crossplane-provider-aws-cloudformation, cluster-autoscaler-fips, kubernetes-dashboard-auth, addon-resizer, metacontroller, nri-kafka, timoni, doppler-kubernetes-operator, kafkaexporter, kaniko-fips, thanos, certificate-transparency,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: bom, spire-controller-manager, grpcurl, kserve, regclient, neuvector-dbgen, gobump, sonobuoy, cni-plugins, falcosidekick, opa-envoy, mkcert, kubernetes-dashboard-api, configmap-reload, gobuster, flux-source-controller, temporal-ui-server, nri-nginx, multus-cni,...

GHSA-V725-9546-7Q7M vulnerabilities

Vulnerabilities for packages: gptscript, zarf, chezmoi, pulumi-language-java, argo-workflows-fips, flux-kustomize-controller, pulumi-language-yaml, k8sgpt, flux-image-automation-controller, apko, trivy-fips, crossplane, grafana-alloy-fips, argocd-image-updater-fips, grafana-alloy, timoni,...

GO-2022-0490 Uses of deprecated API can be used to cause DoS in user-facing endpoints in github.com/argoproj/argo-events

Uses of deprecated API can be used to cause DoS in user-facing endpoints in github.com/argoproj/argo-events...

CVE-2023-37475 vulnerabilities

Vulnerabilities for packages: argo-events, argo-events-fips...

CVE-2023-37475 vulnerabilities

Vulnerabilities for packages: argo-events...

GHSA-9X44-9PGQ-CF45 vulnerabilities

Vulnerabilities for packages: argo-events...

GHSA-9X44-9PGQ-CF45 vulnerabilities

Vulnerabilities for packages: argo-events, argo-events-fips...

CVE-2022-25856

The CVE-2022-25856 entry affects the Argo Events project: the GitArtifactReader.Read() implementation in the sensors/artifacts code path (git.go) allows directory traversal, enabling an attacker to read arbitrary files when a path contains a symbolic link or an implicit directory (e.g., using ../...

CVE-2022-25856

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the g GitArtifactReader.Read API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory...

Insecure path traversal in Git Trigger Source can lead to arbitrary file read

Impact A path traversal issue was found in the g GitArtifactReader.Read API. Read calls into g GitArtifactReader.readFromRepository that opens and reads the file that contains the trigger resource definition: go func g GitArtifactReader readFromRepositoryr git.Repository, dir string No checks are...