PT-2026-24701

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 2.9.0 through 4.0.1 Argo Workflows version 3.7.11 Description Argo Workflows is a container-native workflow engine for Kubernetes. A user who can submit Workflows can bypass security settings defined in a WorkflowTempla...

CVE-2026-31892: Incorrect Authorization

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions prior to Argo Workflows 4.0.2 and 3.7.11 contained security vulnerabilities. These vulnerabilities stemmed from the ability for users to bypass all security settings in the...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: step-issuer-fips, k8sgpt, crossplane-provider-aws-memorydb-fips, kube-logging-logging-operator, crossplane-fips, prometheus-bind-exporter, mesosphere-vsphere-csi-fips, eks-distro, flannel-fips, cephcsi-fips, terraform-provider-google, mattermost-fips,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: step-issuer-fips, nri-nginx, k8sgpt, vertical-pod-autoscaler-fips, kratos, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, pguser, crossplane-fips, renovate, prometheus-bind-exporter, mesosphere-vsphere-csi-fips,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, nri-nginx, k8sgpt, vertical-pod-autoscaler-fips, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, pguser, crossplane-fips, prometheus-bind-exporter, mesosphere-vsphere-csi-fips, eks-distro,...

GHSA-WF6X-7X77-MVGW vulnerabilities

Vulnerabilities for packages: kubeflow-katib, vitess, rancher-api-ui, argo-workflows...

CVE-2026-29063 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, vitess, rancher-api-ui, argo-workflows...

GHSA-WF6X-7X77-MVGW vulnerabilities

Vulnerabilities for packages: kubeflow-katib, gitlab-rails-ce-fips, authentik-fips, rancher-api-ui, vitess, gitlab-rails-ce, authentik, argo-workflows, arangodb...

CVE-2026-29063 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, gitlab-rails-ce-fips, authentik-fips, rancher-api-ui, vitess, gitlab-rails-ce, authentik, argo-workflows, arangodb...

CLEANSTART-2026-BY85815 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Multiple security vulnerabilities affect the argo-workflows package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-MW73882 filippo

Multiple security vulnerabilities affect the argo-workflows package. filippo. See references for individual vulnerability details...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: hydra, policy-controller, crossplane-provider-aws-cloudfront, apko, opentofu, melange, ksops, crossplane-provider-keycloak, crossplane-provider-azure-storage, kyverno-notation-aws, crossplane-provider-family-aws, flux-helm-controller, pulumi-language-dotnet,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: hydra, policy-controller, crossplane-provider-aws-cloudfront, apko, opentofu, melange, ksops, crossplane-provider-keycloak, crossplane-provider-azure-storage, kyverno-notation-aws, crossplane-provider-family-aws, flux-helm-controller, pulumi-language-dotnet,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: docker, lazygit, crossplane-provider-aws-memorydb-fips, crossplane-fips, trivy-operator, datadog-agent-fips, policy-controller, rclone-fips, kots, crossplane-provider-aws-rds-fips, skaffold, vault, terraform-provider-pagerduty-fips, flux-kustomize-controller,...

CLEANSTART-2026-DS30740 go-git is a highly extensible git implementation library written in pure Go

Multiple security vulnerabilities affect the argo-workflows-fips package. go-git is a highly extensible git implementation library written in pure Go. See references for individual vulnerability details...

CLEANSTART-2026-OA82425 go-git is a highly extensible git implementation library written in pure Go

Multiple security vulnerabilities affect the argo-workflows package. go-git is a highly extensible git implementation library written in pure Go. See references for individual vulnerability details...

CLEANSTART-2026-UQ43569 go-git is a highly extensible git implementation library written in pure Go

Multiple security vulnerabilities affect the argo-workflows package. go-git is a highly extensible git implementation library written in pure Go. See references for individual vulnerability details...

CLEANSTART-2026-IA56615 go-git is a highly extensible git implementation library written in pure Go

Multiple security vulnerabilities affect the argo-workflows package. go-git is a highly extensible git implementation library written in pure Go. See references for individual vulnerability details...

CLEANSTART-2026-DV04077 go-git is a highly extensible git implementation library written in pure Go

Multiple security vulnerabilities affect the argo-workflows-fips package. go-git is a highly extensible git implementation library written in pure Go. See references for individual vulnerability details...