CLEANSTART-2026-YP71485 Immutable

Security vulnerability affects the argo-workflows package. Immutable...

CLEANSTART-2026-IW41585 Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)

Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ListArchivedWorkflows handler in server/workflowarchive/archivedworkflowserver.go. An attacker can read archived workflows from other namespaces by sending a metadata.namespace!=...

EUVD-2026-83619

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass in the ListArchivedWorkflows API. The root cause is a failure to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals (negated) operator . An attacker with namespace-scoped list...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

PT-2026-95875

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.1.0 through 4.1.3 Description An authorization bypass exists in the ListArchivedWorkflows function. The issue occurs when the metadata.namespace field selector utilizes the NotEquals operator, causing a failure to app...

CVE-2026-93991: Authorization Bypass Through User-Controlled Key

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: envoy-ai-gateway-fips, cilium, llm-d-router-fips, cluster-api-aws-controller, cluster-api-helm-controller, cert-manager-csi-driver-fips, authentik, addon-resizer-fips, kafka-proxy, crossplane-provider-family-gcp-config-fips, vitess, coredns-fips, grafana-alloy-fips,...

GHSA-8WMF-6V46-5GFG vulnerabilities

Vulnerabilities for packages: envoy-ai-gateway-fips, cilium, llm-d-router-fips, cluster-api-aws-controller, cluster-api-helm-controller, cert-manager-csi-driver-fips, authentik, addon-resizer-fips, kafka-proxy, crossplane-provider-family-gcp-config-fips, vitess, coredns-fips, grafana-alloy-fips,...

CLEANSTART-2026-LB77513 Security fix for CVE-2025-62156 applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NK14578 Security fix for CVE-2025-62157 applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2025-WY26616 Security fix for CVE-2025-32445 applied in: argo-workflows-fips 3.5.15-r1

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UC71482 Security fix for CVE-2025-8556 applied in: argo-workflows-fips 3.5.15-r1, argo-workflows-fips 3.6.13-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, policy-controller 0.12.1-r1

CVE-2025-8556 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MJ31309 Security fix for CVE-2026-25934 applied in: argo-cd 3.0.23-r0, argo-cd-fips 3.0.22-r1, argo-cd-fips 3.1.11-r0, argo-cd-fips 3.1.12-r1, argo-cd-fips 3.2.5-r0, argo-cd-fips 3.2.7-r0, argo-workflows 3.6.17-r0, argo-workflows 3.6.18-r0, argo-workflows 3.7.7-r0, argo-workflows 3.7.8-r0, argo-workflows 3.7.9-r0, argo-workflows-fips 3.6.16-r0, argo-workflows-fips 3.6.17-r1, argo-workflows-fips 3.6.18-r0, argo-workflows-fips 3.7.9-r0, argo-workflows-fips 3.7.9-r1, external-secrets 0.20.4-r0, external-secrets-fips 0.17.0-r2, external-secrets-fips 0.20.4-r2, flux-image-automation-controller-fips 4.0.1-r0, gptscript 0.9.8-r0, gptscript 0.9.9-r0, grafana-alloy 1.13.1-r0, grafana-alloy 1.13.2-r0, kubescape 3.0.47-r0, kubevela 1.10.8-r0, pulumi-kubernetes-operator 1.16.0-r0, syft 1.39.0-r0, timoni 0.25.2-r0

CVE-2026-25934 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RC77081 Security fix for CVE-2026-26996 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, npm 11.10.0-r1, opensearch-dashboards-fips 3.5.0-r2, renovate 43.4.3-r1, renovate 43.4.4-r0

CVE-2026-26996 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JJ50819 Security fix for CVE-2025-15558 applied in: argo-workflows 3.7.10-r4, argo-workflows 3.7.7-r0, argo-workflows 4.0.2-r0, argo-workflows-fips 3.6.19-r1, argo-workflows-fips 3.7.10-r2, argo-workflows-fips 4.0.2-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, crossplane 2.0.2-r1, dynatrace-operator 1.8.1-r3, flux-image-automation-controller-fips 4.0.1-r0, gptscript 0.6.0-r0, gptscript 0.7.1-r0, gptscript 0.8.5-r0, gptscript 0.9.8-r0, harbor 2.13.4-r1, harbor-fips 2.13.4-r0, harbor-fips 2.14.2-r1, harbor-scanner-trivy 0.35.1-r0, harbor-scanner-trivy-fips 0.35.1-r0, istio 1.27.1-r0, istio 1.28.4-r0, istio 1.28.5-r2, istio 1.28.7-r2, istio 1.29.0-r0, istio 1.29.1-r1, istio-fips 1.25.5-r4, istio-fips 1.27.8-r2, istio-fips 1.28.5-r2, istio-fips 1.29.1-r1, istio-pilot-discovery-fips 1.28.3-r1, kubescape 3.0.47-r1, kubevela 1.10.8-r0, kyverno-fips 1.13.6-r9, kyverno-fips 1.16.1-r3, kyverno-fips 1.16.3-r3, kyverno-fips 1.17.1-r2, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r7, minio-operator 7.0.1-r5, minio-operator-fips 5.0.18-r8, paranoia 0.2.1-r0, paranoia 0.3.1-r0, paranoia 0.4.0-r0, policy-controller 0.12.1-r1, rancher-agent 2.11.15-r1, spire-server 1.13.5-r0, syft 1.39.0-r2, tekton-chains 0.26.0-r3, tekton-pipelines 1.7.0-r0, tekton-pipelines 1.9.2-r0, tekton-pipelines-fips 1.10.2-r0, tekton-pipelines-fips 1.11.0-r0, tekton-pipelines-fips 1.7.0-r0, tekton-pipelines-fips 1.9.2-r0, timoni 0.25.2-r0, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn-fips 0.43.0-r4

CVE-2025-15558 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...