1786 matches found
BIT-ARGO-WORKFLOWS-2026-42295 Argo Workflows: Exposure of artifact repository credentials
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...
BIT-ARGO-WORKFLOWS-2026-42294 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...
BIT-ARGO-WORKFLOWS-2026-42183 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...
GHSA-389R-GV7P-R3RP vulnerabilities
Vulnerabilities for packages: external-secrets-operator, grype, rancher-fleet, xeol, nuclei, trivy-operator, argo-cd, bom, melange, kubescape, gitaly, cerbos, gitsign, flux-image-automation-controller, flux-source-controller, pulumi-language-yaml, argo-workflows, tfsec, gitea, src-fingerprint,...
CVE-2026-45022 vulnerabilities
Vulnerabilities for packages: crossplane, gomplate-fips, argo-workflows-fips, gomplate, pulumi-language-java, gitea-fips, kargo, xeol, dagger, pulumi-language-yaml, cloudbeat, trivy-operator, coder-fips, zarf-fips, kubevela-fips, pulumi, jfrog-cli, goreleaser, rancher-fleet, cerbos-fips, bom,...
GHSA-389R-GV7P-R3RP vulnerabilities
Vulnerabilities for packages: crossplane, gomplate-fips, argo-workflows-fips, gomplate, pulumi-language-java, gitea-fips, kargo, xeol, dagger, pulumi-language-yaml, cloudbeat, trivy-operator, coder-fips, zarf-fips, kubevela-fips, pulumi, jfrog-cli, goreleaser, rancher-fleet, cerbos-fips, bom,...
PT-2026-40269
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...
PT-2026-40451
Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.21 Description An authorization bypass exists in workflow execution allowing authenticated users to execute arbitrary workflows. By referencing victim workflow UUIDs without proper access validation, attackers can...
Heym 安全漏洞
Heym is an open-source AI-native workflow automation platform developed by heymrun. Versions of Heym prior to 0.0.21 contained security vulnerabilities. These vulnerabilities stemmed from authorization bypasses during workflow execution, allowing authenticated users to execute arbitrary workflows...
PT-2026-40273
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/sync cm.go performs zero authorization checks on all CRUD operations create, read,...
PT-2026-40270
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...
PT-2026-40271
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...
PT-2026-40272
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...
CVE-2026-44246: Improper Neutralization of Special Elements in Output Used by a Downstream Component
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowednonwriteusers: $...
Comment and Control: Hijacking Agentic Workflows Via Context-Grounded Evolution
Automation platforms such as GitHub Actions and n8n are increasingly adopting so-called agentic workflows, which integrate Large Language Model LLM agents for tasks such as code review and data synchronization. While bringing convenience for developers, this integration exposes a new risk: An...
CVE-2026-44728 vulnerabilities
Vulnerabilities for packages: vitess, kubeflow-katib...
GHSA-FV7C-FP4J-7GWP vulnerabilities
Vulnerabilities for packages: vitess, kubeflow-katib...
CVE-2026-6322 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, wazuh-dashboard-fips, prism, serve, drupal, argo-workflows, tileserver-gl-fips, gitlab-rails-ce-fips, langfuse, langfuse-fips, opensearch-dashboards, wazuh-dashboard, opensearch-dashboards-fips, arangodb, kibana, keep, tileserver-gl,...