690 matches found
CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
CVE-2026-54526
Argo Workflows vulnerability CVE-2026-54526: Incomplete fix for CVE-2026-31892 allows bypassing Strict/Secure templateReferencing via ArtifactGC.PodSpecPatch in ArtifactGC, enabling attacker-controlled pod settings (hostPath, privileged, image/command, hostNetwork). Affects versions prior to 3.7....
CVE-2026-54526: Improper Access Control
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
PT-2026-60560
Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.7.15 Argo Workflows versions prior to 4.0.6 Description An incomplete allow-list implementation in the ValidateUserOverrides and SanitizeUserWorkflowSpec functions within workflow/util/merge.go allows for the...
GHSA-XCGV-8MV7-V8C7 vulnerabilities
Vulnerabilities for packages: azuredisk-csi-fips, fleet-server, argo-workflows-fips, vault-fips, nerdctl-fips, opentelemetry-collector-k8s, kube-conformance, timestamp-authority-fips, podman-fips, src, kube-state-metrics, k3s, helmfile, argo-cd, buildkitd-fips, cloud-sql-proxy, calico-fips,...
CVE-2026-6402 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, argo-workflows, arangodb, gitlab-rails-ce-fips, kubeflow-katib...
GHSA-79CF-XCQC-C78W vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, argo-workflows, arangodb, gitlab-rails-ce-fips, kubeflow-katib...
CVE-2026-42295 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
GHSA-7VF8-2CR6-54MF vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
CVE-2026-42297 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
GHSA-XCHC-CQWG-G76Q vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
CVE-2026-42183 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
GHSA-P4GQ-3VXJ-F4JQ vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
GHSA-7VF8-2CR6-54MF vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips...
CVE-2026-42183 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips...
GHSA-P4GQ-3VXJ-F4JQ vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips...
CVE-2026-42297 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips...