BIT-ARGO-WORKFLOWS-2026-42296 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

BIT-ARGO-WORKFLOWS-2026-42295 Argo Workflows: Exposure of artifact repository credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

BIT-ARGO-WORKFLOWS-2026-42294 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

BIT-ARGO-WORKFLOWS-2026-42183 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: trivy-operator, external-secrets-operator, osv-scanner, kubescape, grype, kubevela, argo-events, gitea, argocd-image-updater, pulumi-kubernetes-operator, wolfictl, skaffold, argo-cd, grafana-alloy, pulumi-language-dotnet, kaniko, pulumi-language-java, argo-workflows,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, gitlab-rails-ce, kyverno-fips, apko-fips, cg, gitsign, nfpm, steampipe, flux, pulumi-kubernetes-operator, redpanda-console, witness, trivy-operator, gomplate, cloudbeat, chainctl-fips, gomplate-fips, terragrunt-fips, guac, gitea, kyverno,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, gitlab-rails-ce, kyverno-fips, apko-fips, cg, gitsign, nfpm, steampipe, flux, pulumi-kubernetes-operator, redpanda-console, witness, trivy-operator, gomplate, cloudbeat, chainctl-fips, gomplate-fips, terragrunt-fips, guac, gitea, kyverno,...

PT-2026-40273

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/sync cm.go performs zero authorization checks on all CRUD operations create, read,...

PT-2026-40269

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

PT-2026-40270

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

PT-2026-40271

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

PT-2026-40272

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

GHSA-FV7C-FP4J-7GWP vulnerabilities

Vulnerabilities for packages: kubeflow-katib, vitess...

CVE-2026-44728 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, vitess...

GHSA-FV7C-FP4J-7GWP vulnerabilities

Vulnerabilities for packages: kubeflow-katib, py3-captum, argo-workflows, gitlab-rails-ce, gitlab-rails-ce-fips, emscripten, vitess, arangodb...

CVE-2026-44728 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, py3-captum, argo-workflows, gitlab-rails-ce, gitlab-rails-ce-fips, emscripten, vitess, arangodb...

CVE-2026-6322 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, wazuh-dashboard, keep-fips, tileserver-gl-fips, drupal, saf, tileserver-gl, langfuse-fips, prism, keep, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, vitess, commercial-gitlab-rails-ee, langfuse, argo-workflows,...

GHSA-V39H-62P7-JPJC vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, wazuh-dashboard, keep-fips, tileserver-gl-fips, drupal, saf, tileserver-gl, langfuse-fips, prism, keep, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, vitess, commercial-gitlab-rails-ee, langfuse, argo-workflows,...

CVE-2026-42296

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

CVE-2026-42297

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...