1756 matches found
GHSA-48P8-G2FX-3WWM Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...
CLEANSTART-2026-ES11075 Security fixes in argo-events 1.9.10-r1
Package argo-events version 1.9.10-r1 fixes 17 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-33186, ghsa-mh2q-q3fh-2475, CVE-2026-29181...
CLEANSTART-2026-EU00318 Security fixes in argo-workflows 3.7.17-r1
Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...
CLEANSTART-2026-KJ21484 Security fixes in argo-events 1.6.3-r1
Package argo-events version 1.6.3-r1 fixes 9 vulnerabilities: CVE-2022-1996, ghsa-r48q-9g5r-8q2h, ghsa-p77j-4mvh-x3m3, ghsa-m425-mq94-257g, CVE-2026-33186...
CLEANSTART-2026-DT69250 Security fixes in argo-cd 3.4.5-r1
Package argo-cd version 3.4.5-r1 fixes 9 vulnerabilities: ghsa-jxpm-75mh-9fp7, ghsa-8xwf-rjm4-xvhv, ghsa-vh4v-2xq2-g5cg, ghsa-xf85-363p-868w, CVE-2026-50151...
CVE-2026-18621
A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...
CVE-2026-18621 Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...
CVE-2026-18621
CVE-2026-18621 affects Data Science Pipelines (DSP). A flaw allows a user with namespace editor privileges to bypass hardening by submitting a malicious Argo Workflow via the V1 API path, enabling the API server to create pods with elevated privileges (a confused-deputy scenario). Successful expl...
CVE-2026-18621
A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...
EUVD-2026-55814
A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...
CVE-2026-18621 Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...
CVE-2026-18621
A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...
PT-2026-69960
Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the 'V1 API' path. This issue allows the API server t...
SUSE CVE-2026-45737
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretDatatarget, live, ... does...
SUSE CVE-2026-45738
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...
CLEANSTART-2026-XI65728 Security fixes in argo-workflows-fips 3.6.18 r0
Package argo-workflows-fips version 3.6.18 r0 fixes 2 vulnerabilities: CVE-2026-24051, CVE-2026-27141...
CLEANSTART-2026-ZW70206 Security fixes in argo-workflows-fips 3.7.0-r0
Package argo-workflows-fips version 3.7.0-r0 fixes 3 vulnerabilities: CVE-2025-47907, CVE-2025-0913, CVE-2025-4673...
CLEANSTART-2026-SZ84105 Security fixes in argo-rollouts-fips 1.9.0-r0
Package argo-rollouts-fips version 1.9.0-r0 fixes 13 vulnerabilities: ghsa-93mq-9ffx-83m2, ghsa-cfpf-hrx2-8rv6, ghsa-gxhx-2686-5h9g, ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3...