CVE-2026-54526

Argo Workflows vulnerability CVE-2026-54526: Incomplete fix for CVE-2026-31892 allows bypassing Strict/Secure templateReferencing via ArtifactGC.PodSpecPatch in ArtifactGC, enabling attacker-controlled pod settings (hostPath, privileged, image/command, hostNetwork). Affects versions prior to 3.7....

PT-2026-60560

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.7.15 Argo Workflows versions prior to 4.0.6 Description An incomplete allow-list implementation in the ValidateUserOverrides and SanitizeUserWorkflowSpec functions within workflow/util/merge.go allows for the...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: knative-net-istio-fips, helmfile, containerd, grafana-operator, argo-cd-fips, art, harbor-fips, keda-fips, pulumi-language-yaml, pulumi-language-dotnet, cluster-api, cloud-provider-aws, undock, k3s, helm, commercial-spilo, grafana-alloy-fips, buildkite-agent-fips,...

GHSA-79CF-XCQC-C78W vulnerabilities

Vulnerabilities for packages: kubeflow-katib, argo-workflows...

CVE-2026-6402 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, argo-workflows...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, argo-workflows...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, argo-workflows...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, argo-workflows...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, argo-workflows...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, argo-workflows...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, argo-workflows...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: drone, kubevela-fips, containerd, argo-cd-fips, harbor-fips, keda-fips, trivy-operator, trivy, cloud-provider-aws, tigera-operator, k3s, gitlab-kas, helm, gitea, nerdctl, seaweedfs-rocksdb-fips, minio-fips, flux-source-controller-fips, terraform, reports-server,...

GO-2026-5751 Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows

Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows...

GO-2026-5527 Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS gatekeeper.go in github.com/argoproj/argo-workflows...