CLEANSTART-2026-VJ56922 Security fixes for CVE-2025-15558, CVE-2025-61729, CVE-2026-25934, CVE-2026-26958, CVE-2026-33186, ghsa-2464-8j7c-4cjm, ghsa-2x5j-vhc8-9cwm, ghsa-37cx-329c-33x3, ghsa-fv92-fjc5-jj9h, ghsa-fw7p-63qq-7hpr, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3 applied in versions: 3.6.16-r0, 3.7.11-r0, 3.7.4-r0, 3.7.9-r0, 4.0.1-r0, 4.0.2-r0

Multiple security vulnerabilities affect the argo-workflows package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: arangodb, kubeflow-pipelines, json-server, langfuse, kubescape-grype-offline-db, langfuse-fips, sqlpad, wazuh-dashboard, gitlab-rails-ce, gitlab-rails-ce-fips, pelias-api, thingsboard-fips, py3-captum, wazuh-dashboard-fips, kubeflow-katib, kubeflow-centraldashboard,...

GHSA-37CH-88JC-XWX2 vulnerabilities

Vulnerabilities for packages: arangodb, kubeflow-pipelines, json-server, langfuse, kubescape-grype-offline-db, langfuse-fips, sqlpad, wazuh-dashboard, gitlab-rails-ce, gitlab-rails-ce-fips, pelias-api, thingsboard-fips, py3-captum, wazuh-dashboard-fips, kubeflow-katib, kubeflow-centraldashboard,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: argo-cd, guac, nemo, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, zarf-fips, argo-events-fips, melange, google-osconfig-agent, skaffold, argo-events, xeol, nuclei, trufflehog, cerbos-fips, zot, crossplane, chainctl-fips, pulumi-kubernetes-operator,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: argo-cd, guac, nemo, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, zarf-fips, argo-events-fips, melange, google-osconfig-agent, skaffold, argo-events, xeol, nuclei, trufflehog, cerbos-fips, zot, crossplane, chainctl-fips, pulumi-kubernetes-operator,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argo-cd, guac, nemo, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, zarf-fips, argo-events-fips, melange, google-osconfig-agent, skaffold, argo-events, xeol, nuclei, trufflehog, cerbos-fips, zot, crossplane, chainctl-fips, pulumi-kubernetes-operator,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: argo-cd, guac, nemo, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, zarf-fips, argo-events-fips, melange, google-osconfig-agent, skaffold, argo-events, xeol, nuclei, trufflehog, cerbos-fips, zot, crossplane, chainctl-fips, pulumi-kubernetes-operator,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, teleport, gitea, gitsign, bom, guac, src-fingerprint, trivy-operato...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, teleport, gitea, gitsign, bom, guac, src-fingerprint, trivy-operato...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, teleport, gitea, gitsign, bom, guac, src-fingerprint, trivy-operato...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, teleport, gitea, gitsign, bom, guac, src-fingerprint, trivy-operato...

GHSA-37CH-88JC-XWX2 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, json-server, kubeflow-pipelines, argo-workflows, sqlpad, kubeflow-centraldashboard...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, json-server, kubeflow-pipelines, argo-workflows, sqlpad, kubeflow-centraldashboard...

Improper Handling Of Symbolic Links

github.com/argoproj/argo-workflows is vulnerable to Improper Handling Of Symbolic Links. The vulnerability is due to flawed validation in the untar process when resolving symbolic links, which allows an attacker to overwrite critical files such as /var/run/argo/argoexec with a malicious script th...

SUSE CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

SUSE CVE-2026-31892

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

GO-2026-4737 Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd

Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd...

GHSA-594F-3595-C47V Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

Summary The terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 "Unexpected session resumption in crypto/tls". Details See https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability. Provider versions starting with v7.15.1 are using go 1.25.8 for buildin...

BIT-ARGO-WORKFLOWS-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

BIT-ARGO-WORKFLOWS-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...