Argo Workflows 代码问题漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had code vulnerabilities. These vulnerabilities stemmed from a null pointer dereferencing in the rbcAuthorization function in...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had a security vulnerability. This vulnerability stemmed from the ConfigMap-backed provider in the Sync Service not performing authorization checks...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: vault, spire-server, rke2-runtime, pgtimetable, step, gitlab-cng-fips, flyte, dapr, gotrue-fips, seaweedfs, spqr, gotrue, kube-bench-fips, certificate-transparency, harbor, dapr-fips, authentik-fips, grafana-alloy-fips, step-issuer, juicefs, spicedb-fips, teleport,...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, py3-captum, kubeflow-katib, sqlpad, nextcloud-server, tensorflow-gpu-jupyter, langfuse, dbgate, arangodb, actions-runner, kibana, azurite, drupal, py3-jupyterlab, renovate, opensearch-dashboards-fips, jupyter-base-notebook, prism,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: syft, bom, kargo, zarf, packer, zarf-fips, pulumi, trufflehog-fips, scorecard, google-osconfig-agent, kubescape-server, k9s-fips, gitsign, melange, nuclei, apko, jfrog-cli, flux-source-controller, xeol, xeol-fips, grafana-alloy-fips, argo-events-fips,...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-katib, opensearch-dashboards, jitsucom-jitsu, kubeflow-centraldashboard, code-server, prism, kubeflow-pipelines, langfuse, argo-workflows, py3-jupyterlab, npm, renovate, sqlpad, nextcloud-server, saf...

Argo vulnerable to exposure of artifact repository credentials

Summary The workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc. in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. Note: This is an...

GHSA-7VF8-2CR6-54MF Argo vulnerable to exposure of artifact repository credentials

Summary The workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc. in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. Note: This is an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the JoinWorkflowSpec process. An attacker can gain unauthorized access to host networking, override service account assignments, modify pod security contexts, add tolerations, or enable service account token...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the addWebhookAuthorization function. An attacker can cause excessive memory allocation by sending a large request body to the publicly accessible /api/v1/events/ endpoint,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the addWebhookAuthorization function. An attacker can cause excessive memory allocation by sending a large request body to the publicly accessible /api/v1/events/ endpoint,...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the configMapSyncProvider process. An attacker can create, read, update, or delete Kubernetes ConfigMaps containing synchronization limits by sending crafted requests with any Bearer token, including fake tokens...

CVE-2026-40886

A flaw was found in Argo Workflows, an open-source system for managing tasks in Kubernetes. An attacker with appropriate permissions can trigger a system-wide crash by submitting a specially crafted workflow pod with a malformed annotation. This vulnerability leads to a persistent Denial of Servi...

BIT-ARGO-WORKFLOWS-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the podGCFromPod function when parsing the workflows.argoproj.io/pod-gc-strategy annotation. An attacker can cause the controller process to crash and enter a persistent crash loop by creating a...

EUVD-2026-25267

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller...

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

GHSA-5JV8-H7QH-RF5P Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-katib, opensearch-dashboards, jitsucom-jitsu, kubeflow-centraldashboard, code-server, prism, kubeflow-pipelines, langfuse, argo-workflows, py3-jupyterlab, npm, renovate, sqlpad, nextcloud-server, saf...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: kine, caddy, telegraf, grafana-alloy, certificate-transparency, azure-service-operator, dapr, gitness, sftpgo-plugin-eventstore, temporal-server, grafana, steampipe, step-issuer, pgtimetable, spqr, falcosidekick, wal-g, openfga, k3s, kuma, keda, argo-workflows,...