CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

CVE-2026-31892

CVE-2026-31892 affects Argo Workflows (open-source Kubernetes workflow engine). A user who can submit a Workflow can bypass security settings defined in a referenced WorkflowTemplate by submitting a podSpecPatch in the Workflow, taking precedence during spec merging and applying to the pod with n...

CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

CVE-2026-31892

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

CVE-2026-28229

Argo Workflows (open source container-native workflow engine for Kubernetes) is affected prior to version 4.0.2 and 3.7.11. The vulnerability affects the WorkflowTemplates and ClusterWorkflowTemplates endpoints, allowing any client with an Authorization: Bearer nothing token to retrieve sensitive...

CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

Unauthorized access to Argo Workflows Template

Summary Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. Details...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the workflowtemplateserver and clusterworkflowtemplateserver components. An attacker can obtain sensitive information, such as embedded secrets and resource manifests, by sending unauthorized requests with a...

EUVD-2026-11196

Unauthorized access to Argo Workflows Template...

PT-2026-24701

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 2.9.0 through 4.0.1 Argo Workflows version 3.7.11 Description Argo Workflows is a container-native workflow engine for Kubernetes. A user who can submit Workflows can bypass security settings defined in a WorkflowTempla...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions prior to Argo Workflows 4.0.2 and 3.7.11 contained security vulnerabilities. These vulnerabilities stemmed from the ability for users to bypass all security settings in the...

Argo Workflows 安全漏洞

Argo Workflows is an open-source, container-native workflow engine for Kubernetes, part of the Argo project. Versions prior to Argo Workflows 4.0.2 and 3.7.11 contained security vulnerabilities. These vulnerabilities stemmed from the workflow template endpoints, which allowed any client to access...

PT-2026-24700

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 4.0.2 and 3.7.11 Description Argo Workflows, an open source container-native workflow engine for Kubernetes, has an issue where Workflow templates endpoints allow any client to retrieve WorkflowTemplates and...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager-fips, external-secrets-operator, gomplate-fips, nri-postgresql, argo-rollouts, azuredisk-csi, crossplane-provider-aws-lambda-fips, kubo-fips, longhorn-cli-fips, minify, timoni, keda-fips, temporal-server,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager-fips, external-secrets-operator, gomplate-fips, argo-rollouts, azuredisk-csi, crossplane-provider-aws-lambda-fips, kubo-fips, timoni, keda-fips, temporal-server, secrets-store-csi-driver-provider-gcp, falcoctl,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager-fips, external-secrets-operator, overmind, gomplate-fips, nri-postgresql, argo-rollouts, azuredisk-csi, crossplane-provider-aws-lambda-fips, kubo-fips, longhorn-cli-fips, minify, timoni, keda-fips, temporal-server,...