GO-2026-5148 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2024-3303 vulnerabilities

Vulnerabilities for packages: argo-workflows...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: grype, teleport, syft, flux-source-controller, kubescape, bom, gitlab-runner, melange, chezmoi, xeol, tfsec, trivy, gptscript, wolfictl, scorecard, pulumi, flux, osv-scanner, rancher-fleet, gitsign, nuclei, gitaly, gitea, grafana-alloy, crossplane,...

GO-2025-4024 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2026-4350 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2025-4223 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2024-2962 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kubeflow-katib, argo-workflows...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: caddy, argo-workflows, step-ca, kots, step, trillian...

GO-2026-5235 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2025-4023 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2026-5527 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, k8sgpt, argo-workflows, argo-rollouts, grafana-alloy, amazon-cloudwatch-agent, opentelemetry-collector, nats, kargo, opentelemetry-collector-contrib, splunk-otel-collector...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: caddy, argo-workflows, ferretdb, kine, kots, step, step-ca, temporal-server, trillian, spicedb, kube-bench, src, k3s, amass...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: trino, goreleaser, k8sgpt, flux-source-controller, kubescape, prometheus-operator, ksops, step-ca, chezmoi, py3-azure-identity, trivy, wal-g, opentelemetry-collector-contrib, pulumi, fulcio, flux, rekor, restic, flux-kustomize-controller, up, nuclei, harbor-registry,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: flux-source-controller, cloudflared, kubescape, fulcio, rekor, flux-kustomize-controller, gitsign, aactl, terragrunt, argo-workflows, tekton-chains, slsa-verifier, oauth2-proxy, vexctl, sops, spire-server, dex, cosign, kots, tkn...

EUVD-2026-45029

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...

GHSA-48P8-G2FX-3WWM Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CLEANSTART-2026-EU00318 Security fixes in argo-workflows 3.7.17-r1

Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...