Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ListArchivedWorkflows handler in server/workflowarchive/archivedworkflowserver.go. An attacker can read archived workflows from other namespaces by sending a metadata.namespace!=...

EUVD-2026-83619

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass in the ListArchivedWorkflows API. The root cause is a failure to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals (negated) operator . An attacker with namespace-scoped list...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

PT-2026-95875

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.1.0 through 4.1.3 Description An authorization bypass exists in the ListArchivedWorkflows function. The issue occurs when the metadata.namespace field selector utilizes the NotEquals operator, causing a failure to app...

CVE-2026-93991: Authorization Bypass Through User-Controlled Key

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

GHSA-8WMF-6V46-5GFG vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, jobset-fips, eck-operator-fips, stunner-gateway-operator, buildah, crossplane-provider-gcp-fips, kcp, tempo-fips, argo-workflows, keda-fips, ops-agent, kong-ingress-controller-fips, cluster-api-provider-vsphere, consul-k8s-fips,...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, jobset-fips, eck-operator-fips, stunner-gateway-operator, buildah, crossplane-provider-gcp-fips, kcp, tempo-fips, argo-workflows, keda-fips, ops-agent, kong-ingress-controller-fips, cluster-api-provider-vsphere, consul-k8s-fips,...

CLEANSTART-2026-WY17221 Security fix for ghsa-c2hv-4pfj-mm2r applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SQ12497 Security fix for ghsa-p84v-gxvw-73pf applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NK14578 Security fix for CVE-2025-62157 applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LB77513 Security fix for CVE-2025-62156 applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2025-GN45223 Security fix for ghsa-xr7q-jx4m-x55m applied in: argo-workflows-fips 3.5.15-r1

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2025-XH32250 Security fix for ghsa-hmp7-x699-cvhq applied in: argo-workflows-fips 3.5.15-r1

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2025-WY26616 Security fix for CVE-2025-32445 applied in: argo-workflows-fips 3.5.15-r1

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UC71482 Security fix for CVE-2025-8556 applied in: argo-workflows-fips 3.5.15-r1, argo-workflows-fips 3.6.13-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, policy-controller 0.12.1-r1

CVE-2025-8556 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MJ31309 Security fix for CVE-2026-25934 applied in: argo-cd 3.0.23-r0, argo-cd-fips 3.0.22-r1, argo-cd-fips 3.1.11-r0, argo-cd-fips 3.1.12-r1, argo-cd-fips 3.2.5-r0, argo-cd-fips 3.2.7-r0, argo-workflows 3.6.17-r0, argo-workflows 3.6.18-r0, argo-workflows 3.7.7-r0, argo-workflows 3.7.8-r0, argo-workflows 3.7.9-r0, argo-workflows-fips 3.6.16-r0, argo-workflows-fips 3.6.17-r1, argo-workflows-fips 3.6.18-r0, argo-workflows-fips 3.7.9-r0, argo-workflows-fips 3.7.9-r1, external-secrets 0.20.4-r0, external-secrets-fips 0.17.0-r2, external-secrets-fips 0.20.4-r2, flux-image-automation-controller-fips 4.0.1-r0, gptscript 0.9.8-r0, gptscript 0.9.9-r0, grafana-alloy 1.13.1-r0, grafana-alloy 1.13.2-r0, kubescape 3.0.47-r0, kubevela 1.10.8-r0, pulumi-kubernetes-operator 1.16.0-r0, syft 1.39.0-r0, timoni 0.25.2-r0

CVE-2026-25934 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...