519 matches found
CLEANSTART-2026-RU00721 Security fixes for CVE-2025-0913, CVE-2025-15558, CVE-2025-4673, CVE-2025-47907, CVE-2025-47914, CVE-2025-58181, CVE-2025-62156, CVE-2025-62157, CVE-2026-24051, CVE-2026-25934, CVE-2026-26958, CVE-2026-33186, ghsa-37cx-329c-33x3, ghsa-c2hv-4pfj-mm2r, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3, ghsa-p84v-gxvw-73pf applied in versions: 3.7.0-r0, 3.7.3-r0, 3.7.4-r0, 3.7.6-r0, 3.7.9-r0, 3.7.9-r1, 3.7.9-r2, 4.0.2-r0, 4.0.2-r1
Multiple security vulnerabilities affect the argo-workflows-fips package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-LS30652 Security fixes for CVE-2025-0913, CVE-2025-15558, CVE-2025-4673, CVE-2025-47907, CVE-2025-47914, CVE-2025-58181, CVE-2025-62156, CVE-2025-62157, CVE-2026-24051, CVE-2026-25934, CVE-2026-26958, CVE-2026-33186, ghsa-37cx-329c-33x3, ghsa-c2hv-4pfj-mm2r, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3, ghsa-p84v-gxvw-73pf applied in versions: 3.7.0-r0, 3.7.11-r0, 3.7.3-r0, 3.7.4-r0, 3.7.6-r0, 3.7.9-r0, 3.7.9-r1, 3.7.9-r2, 4.0.2-r0
Multiple security vulnerabilities affect the argo-workflows-fips package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-VJ56922 Security fixes for CVE-2025-15558, CVE-2025-61729, CVE-2026-25934, CVE-2026-26958, CVE-2026-33186, ghsa-2464-8j7c-4cjm, ghsa-2x5j-vhc8-9cwm, ghsa-37cx-329c-33x3, ghsa-fv92-fjc5-jj9h, ghsa-fw7p-63qq-7hpr, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3 applied in versions: 3.6.16-r0, 3.7.11-r0, 3.7.4-r0, 3.7.9-r0, 4.0.1-r0, 4.0.2-r0
Multiple security vulnerabilities affect the argo-workflows package. These issues are resolved in later releases. See references for individual vulnerability details...
CVE-2026-4867 vulnerabilities
Vulnerabilities for packages: py3-captum, kubeflow-pipelines, langfuse, argo-workflows, kubeflow-katib, langfuse-fips, thingsboard-fips, sqlpad, wazuh-dashboard-fips, kubeflow-centraldashboard, wazuh-dashboard, kubescape-grype-offline-db, gitlab-rails-ce-fips, json-server, pelias-api,...
GHSA-37CH-88JC-XWX2 vulnerabilities
Vulnerabilities for packages: py3-captum, kubeflow-pipelines, langfuse, argo-workflows, kubeflow-katib, langfuse-fips, thingsboard-fips, sqlpad, wazuh-dashboard-fips, kubeflow-centraldashboard, wazuh-dashboard, kubescape-grype-offline-db, gitlab-rails-ce-fips, json-server, pelias-api,...
GHSA-JHF3-XXHW-2WPP vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, teleport, livekit-cli, skaffold-fips, zarf, cloudbeat, argo-events-fips, google-osconfig-agent, flux-fips, kubescape-server-fips, crossplane, kots, packer-fips, osv-scanner, crossplane-fips, flux-source-controller-fips, grafana-alloy-fips,...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, teleport, livekit-cli, skaffold-fips, zarf, cloudbeat, argo-events-fips, google-osconfig-agent, flux-fips, kubescape-server-fips, crossplane, kots, packer-fips, osv-scanner, crossplane-fips, flux-source-controller-fips, grafana-alloy-fips,...
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, teleport, livekit-cli, skaffold-fips, zarf, cloudbeat, argo-events-fips, google-osconfig-agent, flux-fips, kubescape-server-fips, crossplane, kots, packer-fips, osv-scanner, crossplane-fips, flux-source-controller-fips, grafana-alloy-fips,...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, teleport, livekit-cli, skaffold-fips, zarf, cloudbeat, argo-events-fips, google-osconfig-agent, flux-fips, kubescape-server-fips, crossplane, kots, packer-fips, osv-scanner, crossplane-fips, flux-source-controller-fips, grafana-alloy-fips,...
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: zot, gitea, kargo, nfpm, bom, zarf, nuclei, argo-cd, steampipe, trufflehog, pulumi, snyk-cli, witness, argocd-image-updater, wolfictl, crossplane, kubescape, rancher-fleet, k9s, argo-workflows, flux, gptscript, src-fingerprint, pulumi-language-dotnet, grafana-alloy,...
GHSA-JHF3-XXHW-2WPP vulnerabilities
Vulnerabilities for packages: zot, gitea, kargo, nfpm, bom, zarf, nuclei, argo-cd, steampipe, trufflehog, pulumi, snyk-cli, witness, argocd-image-updater, wolfictl, crossplane, kubescape, rancher-fleet, k9s, argo-workflows, flux, gptscript, src-fingerprint, pulumi-language-dotnet, grafana-alloy,...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: zot, gitea, kargo, nfpm, bom, zarf, nuclei, argo-cd, steampipe, trufflehog, pulumi, snyk-cli, witness, argocd-image-updater, wolfictl, crossplane, kubescape, rancher-fleet, k9s, argo-workflows, flux, gptscript, src-fingerprint, pulumi-language-dotnet, grafana-alloy,...
GHSA-37CH-88JC-XWX2 vulnerabilities
Vulnerabilities for packages: argo-workflows, json-server, sqlpad, kubeflow-katib, kubeflow-centraldashboard, kubeflow-pipelines...
CVE-2026-4867 vulnerabilities
Vulnerabilities for packages: argo-workflows, json-server, sqlpad, kubeflow-katib, kubeflow-centraldashboard, kubeflow-pipelines...
Improper Handling Of Symbolic Links
github.com/argoproj/argo-workflows is vulnerable to Improper Handling Of Symbolic Links. The vulnerability is due to flawed validation in the untar process when resolving symbolic links, which allows an attacker to overwrite critical files such as /var/run/argo/argoexec with a malicious script th...
SUSE CVE-2026-28229
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...
SUSE CVE-2026-31892
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...
BIT-ARGO-WORKFLOWS-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...
BIT-ARGO-WORKFLOWS-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...