GO-2025-4223 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2026-5235 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, nats, grafana-alloy, splunk-otel-collector, kargo, opentelemetry-collector-contrib, opentelemetry-collector, argo-rollouts, k8sgpt, amazon-cloudwatch-agent, argo-workflows...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: step, kube-bench, step-ca, kots, caddy, amass, k3s, spicedb, trillian, kine, temporal-server, src, ferretdb, argo-workflows...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux, terragrunt, sqlpad, thanos, rekor, velero, tekton-chains, restic, timestamp-authority, sops, buildkitd, opentelemetry-collector, secrets-store-csi-driver-provider-azure, k8sgpt, goreleaser, bank-vaults, argo-workflows, step-ca, boring-registry, zarf, chezmoi,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: terragrunt, aactl, kots, rekor, tekton-chains, sops, argo-workflows, dex, slsa-verifier, oauth2-proxy, vexctl, spire-server, cosign, tkn, gitsign, flux-kustomize-controller, flux-source-controller, fulcio, kubescape, cloudflared...

EUVD-2026-45029

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

GHSA-48P8-G2FX-3WWM Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CLEANSTART-2026-GP43617 Security fixes in argo-workflows 3.7.17-r2

Package argo-workflows version 3.7.17-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-QH76136 Security fixes in argo-workflows-fips 4.0.6-r1

Package argo-workflows-fips version 4.0.6-r1 fixes 8 vulnerabilities: ghsa-crhj-59gh-8x96, ghsa-389r-gv7p-r3rp, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29, CVE-2026-45022...

CLEANSTART-2026-EU00318 Security fixes in argo-workflows 3.7.17-r1

Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...

PT-2026-85868

Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...

PT-2026-85890

Package argo-workflows version 3.7.17-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

SUSE CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

SUSE CVE-2026-42183

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

SUSE CVE-2026-42294

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

SUSE CVE-2026-42295

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

SUSE CVE-2026-42296

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...