562 matches found
CLEANSTART-2026-AQ85366 Security fixes in argo-workflows-fips 3.7.9-r2
Package argo-workflows-fips version 3.7.9-r2 fixes 3 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958, CVE-2026-24051...
CLEANSTART-2026-PN42288 Security fixes in argo-workflows 3.7.8-r1
Package argo-workflows version 3.7.8-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3, ghsa-9h8m-3fm2-qjrq...
BIT-ARGO-WORKFLOWS-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
CVE-2026-16221 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, librechat, yaml-language-server, arangodb, keep-fips, unleash-fips, wazuh-dashboard, prism, opensearch-dashboards, argo-workflows, renovate, unleash, langfuse-fips, gemini-cli, gitlab-rails-ce-fips, wazuh-dashboard-fips, tileserver-gl, vitess,...
GHSA-V2HH-GCRM-F6HX vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, librechat, yaml-language-server, arangodb, keep-fips, unleash-fips, wazuh-dashboard, prism, opensearch-dashboards, argo-workflows, renovate, unleash, langfuse-fips, gemini-cli, gitlab-rails-ce-fips, wazuh-dashboard-fips, tileserver-gl, vitess,...
CVE-2026-16221 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, vitess, yaml-language-server, langfuse, tileserver-gl, argo-workflows, prism, renovate...
GHSA-V2HH-GCRM-F6HX vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, vitess, yaml-language-server, langfuse, tileserver-gl, argo-workflows, prism, renovate...
CVE-2026-56852 vulnerabilities
Vulnerabilities for packages: coder, envconsul-fips, kubernetes-csi-external-attacher-fips, crossplane-provider-azure-spring, nrdot-collector-k8s-fips, sap-btp-service-operator, hclgrep-fips, thanos, thanos-receive-controller, crossplane-provider-aws-amp-fips, hclmerge, hubble-ui, kube-arangodb,...
GHSA-JPJM-C3R5-Q96R vulnerabilities
Vulnerabilities for packages: coder, envconsul-fips, kubernetes-csi-external-attacher-fips, crossplane-provider-azure-spring, nrdot-collector-k8s-fips, sap-btp-service-operator, hclgrep-fips, thanos, thanos-receive-controller, crossplane-provider-aws-amp-fips, hclmerge, hubble-ui, kube-arangodb,...
CLEANSTART-2026-MY68881 Security fixes for CVE-2023-45288, CVE-2025-15558, CVE-2026-25680, CVE-2026-25681, CVE-2026-26958, CVE-2026-27136, CVE-2026-27145, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-33815, CVE-2026-33816, CVE-2026-34986, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39882, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-389r-gv7p-r3rp, ghsa-3xc5-wrhm-f963, ghsa-78h2-9frx-2jm8, ghsa-crhj-59gh-8x96, ghsa-fw7p-63qq-7hpr, ghsa-hfvc-g4fc-pqhx, ghsa-j88v-2chj-qfwx, ghsa-m3xc-h892-ggx6, ghsa-m7cr-m3pv-hgrp, ghsa-p436-gjf2-799p, ghsa-qw64-3x98-g7q2, ghsa-w5pp-99ch-qj29, ghsa-w8rr-5gcm-pp58 applied in versions: 3.7.15-r0, 4.0.1-r0, 4.0.2-r0, 4.0.3-r0, 4.0.4-r0, 4.0.4-r1, 4.0.5-r0
Multiple security vulnerabilities affect the argo-workflows package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-WY21381 Security fixes for CVE-2023-45288, CVE-2025-15558, CVE-2026-25680, CVE-2026-25681, CVE-2026-26958, CVE-2026-27136, CVE-2026-27145, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-33815, CVE-2026-33816, CVE-2026-34986, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39882, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-389r-gv7p-r3rp, ghsa-3xc5-wrhm-f963, ghsa-78h2-9frx-2jm8, ghsa-crhj-59gh-8x96, ghsa-fw7p-63qq-7hpr, ghsa-hfvc-g4fc-pqhx, ghsa-j88v-2chj-qfwx, ghsa-m3xc-h892-ggx6, ghsa-m7cr-m3pv-hgrp, ghsa-p436-gjf2-799p, ghsa-qw64-3x98-g7q2, ghsa-w5pp-99ch-qj29, ghsa-w8rr-5gcm-pp58 applied in versions: 3.7.15-r0, 4.0.1-r0, 4.0.2-r0, 4.0.3-r0, 4.0.4-r0, 4.0.4-r1, 4.0.5-r0
Multiple security vulnerabilities affect the argo-workflows package. These issues are resolved in later releases. See references for individual vulnerability details...
CVE-2026-54526
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
CVE-2026-54526
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
CVE-2026-54526
Argo Workflows vulnerability CVE-2026-54526: Incomplete fix for CVE-2026-31892 allows bypassing Strict/Secure templateReferencing via ArtifactGC.PodSpecPatch in ArtifactGC, enabling attacker-controlled pod settings (hostPath, privileged, image/command, hostNetwork). Affects versions prior to 3.7....
CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
PT-2026-60560
Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.7.15 Argo Workflows versions prior to 4.0.6 Description An incomplete allow-list implementation in the ValidateUserOverrides and SanitizeUserWorkflowSpec functions within workflow/util/merge.go allows for the...
GHSA-XCGV-8MV7-V8C7 vulnerabilities
Vulnerabilities for packages: gatekeeper-fips, kubernetes-csi-node-driver-registrar, ocm-kubernetes-controller, external-secrets-operator-fips, prometheus-mongodb-exporter, libnvidia-container, grype, buildah-fips, vault-fips, cloud-sql-proxy, authentik, etcd-fips, ocm-cli-fips,...