CVE-2023-24531 vulnerabilities

Vulnerabilities for packages: argo-workflows, newrelic-fluent-bit-output, kubeflow-katib...

GHSA-WR3J-PWJ9-HQQ6 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-katib, arangodb...

CVE-2024-29180 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-katib, arangodb...

CVE-2024-21536 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, kubeflow-katib, arangodb...

GHSA-C7QV-Q95Q-8V27 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, kubeflow-katib, arangodb...

GHSA-CWPG-QGC6-JXVQ vulnerabilities

Vulnerabilities for packages: argo-workflows, newrelic-fluent-bit-output, kubeflow-katib...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: k8sgpt, nats, grafana-alloy, kargo, opentelemetry-collector, argo-rollouts, amazon-cloudwatch-agent, argo-workflows, kubeflow-pipelines, opentelemetry-collector-contrib, splunk-otel-collector...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: k8sgpt, nats, grafana-alloy, kargo, opentelemetry-collector, argo-rollouts, amazon-cloudwatch-agent, argo-workflows, kubeflow-pipelines, opentelemetry-collector-contrib, splunk-otel-collector...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-fips, kargo, splunk-otel-collector-fips, amazon-cloudwatch-agent, argo-rollouts-fips, opentelemetry-collector-contrib, k8sgpt, argo-cd-fips, argo-workflows, argo-workflows-fips, opentelemetry-collector, kubeflow-pipelines, splunk-otel-collecto...

GHSA-67MH-4WV8-2F99 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, vite, argo-workflows...

GHSA-67MH-4WV8-2F99 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, vite, argo-workflows, gitlab-rails-ce-fips, kubeflow-katib...

CVE-2022-29164

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

GHSA-CWPG-QGC6-JXVQ vulnerabilities

Vulnerabilities for packages: kubeflow-katib, newrelic-fluent-bit-output, argo-workflows...

CVE-2025-21614 vulnerabilities

Vulnerabilities for packages: osv-scanner, pulumi-language-dotnet, kargo, melange, src-fingerprint, gitsign, flux-source-controller, k9s, skaffold, flux-image-automation-controller-fips, flux-kustomize-controller-fips, scorecard, go-licenses, gitea-fips, kots, flux-kustomize-controller, k8sgpt,...

Sensitive Information Exposure

github.com/argoproj/argo-workflows/v3 is vulnerable to a Sensitive Information Exposure. The vulnerability is due to the absence of proper authentication checks in the GET Workflow endpoint when retrieving Archived Workflows. Specifically, when using --auth-mode=client, fake or spoofed tokens can...

SUSE CVE-2024-53862

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

GHSA-RHX6-C78J-4Q9W vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, kubeflow-centraldashboard, arangodb, argo-workflows, tileserver-gl-fips, thingsboard, sqlpad, tileserver-gl, kubeflow-pipelines...

GHSA-H36C-M3RF-34H9 vulnerabilities

Vulnerabilities for packages: argo-workflows...

GHSA-H36C-M3RF-34H9 vulnerabilities

Vulnerabilities for packages: argo-workflows, argo-workflows-fips...

GHSA-H36C-M3RF-34H9 Access to Archived Argo Workflows with Fake Token in `client` mode

Summary When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name When using --auth-mode=sso, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint:...