CVE-2026-42297: Missing Authorization

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42183: NULL Pointer Dereference

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had a security vulnerability. This vulnerability stemmed from the fact that the workflow executor recorded all workpiece repository credentials in...

CVE-2026-42294: Allocation of Resources Without Limits or Throttling

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

Argo Workflows 代码问题漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had code vulnerabilities. These vulnerabilities stemmed from a null pointer dereferencing in the rbcAuthorization function in...

claude-skills-exploit

Security Research Skills Reusable skills for vulnerability an...

CVE-2026-44338

PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow throug...

CVE-2026-43331 x86/kexec: Disable KCOV instrumentation after load_segments()

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Disable KCOV instrumentation after loadsegments The loadsegments function changes segment registers, invalidating GS base which KCOV relies on for per-cpu data. When CONFIGKCOV is enabled, any subsequent instrumented C...

CVE-2026-42298: Improper Control of Generation of Code

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

web-app-pentest-playbook

Web Application Pentest Playbook A structured methodology and...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: kube-bench, dapr-fips, openbao, argo-workflows, openbao-fips, falcosidekick-fips, chainloop-control-plane, authentik-fips, cerbos, pgtimetable-fips, kube-bench-fips, chainloop-control-plane-fips, bento-fips, authentik, temporal, spqr, kots, ldap2pg,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: guac, kubescape, terragrunt, cloudbeat, packer, trivy-operator, argo-workflows, gomplate, kaniko, cerbos, kyverno, snyk-cli, flux, syft-fips, crossplane-fips, gitea, kots, gomplate-fips, argocd-image-updater-fips, bom, skaffold-fips, flux-source-controller-fips,...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: kibana, commercial-gitlab-rails-ee, nemo, argo-workflows, opensearch-dashboards, code-server, redisinsight, kubeflow-pipelines, opensearch-dashboards-fips, tensorflow-gpu-jupyter, homepage, dbgate-fips, nextcloud-server, drupal, azurite, npm, langfuse-fips, py3-captu...

[SECURITY] Fedora 43 Update: forgejo-runner-12.7.3-2.fc43

The Forgejo Runner is a daemon that fetches workflows to run from a Forgejo i nstance, executes them, sends back with the logs and ultimately reports its success or failure...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: py3-jupyterlab, kubeflow-centraldashboard, saf, opensearch-dashboards, prism, renovate, code-server, langfuse, sqlpad, nextcloud-server, kubeflow-pipelines, jupyter-base-notebook, jitsucom-jitsu, argo-workflows, npm, kubeflow-katib...

GHSA-7VF8-2CR6-54MF Argo vulnerable to exposure of artifact repository credentials

Summary The workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc. in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. Note: This is an...

Argo vulnerable to exposure of artifact repository credentials

Summary The workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc. in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. Note: This is an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the JoinWorkflowSpec process. An attacker can gain unauthorized access to host networking, override service account assignments, modify pod security contexts, add tolerations, or enable service account token...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the addWebhookAuthorization function. An attacker can cause excessive memory allocation by sending a large request body to the publicly accessible /api/v1/events/ endpoint,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the addWebhookAuthorization function. An attacker can cause excessive memory allocation by sending a large request body to the publicly accessible /api/v1/events/ endpoint,...