CLEANSTART-2026-QV26039 Within HostnameError

Security vulnerability affects the argo-workflows package. Within HostnameError...

CLEANSTART-2026-MF93723 Within HostnameError

Multiple security vulnerabilities affect the argo-workflows package. Within HostnameError. See references for individual vulnerability details...

GHSA-CV78-6M8Q-PH82 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

CVE-2026-23960 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GHSA-CV78-6M8Q-PH82 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows-fips, argo-workflows...

CVE-2026-23960 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows-fips, argo-workflows...

BIT-ARGO-WORKFLOWS-2026-23960 Argo Workflows affected by stored XSS in the artifact directory listing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo...

CVE-2026-23960

A flaw was found in Argo Workflows, an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. This stored Cross-Site Scripting XSS vulnerability in the artifact directory listing allows any workflow author to execute unauthorized JavaScript code in another...

CVE-2026-24001 vulnerabilities

Vulnerabilities for packages: drupal, langfuse, graalvm, thingsboard, argo-workflows, ts-patch, npm, grafana-fips, tileserver-gl, actions-runner, grafana, vitess, semaphore, tileserver-gl-fips, langfuse-fips, prism, kubeflow-katib, sqlpad, renovate, saf, librechat, thingsboard-fips, redisinsight...

CVE-2026-23960

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo...

CVE-2026-23960

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo...

CVE-2026-23960 Argo Workflows affected by stored XSS in the artifact directory listing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo...

CVE-2026-23960

CVE-2026-23960 affects Argo Workflows prior to versions 3.6.17 and 3.7.8. A stored XSS vulnerability in the artifact directory listing can cause arbitrary JavaScript to run in another user’s browser within the Argo Server origin, enabling actions with the victim’s privileges. Affected component: ...

CVE-2026-23960 Argo Workflows affected by stored XSS in the artifact directory listing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo...

CVE-2026-23960 Argo Workflows affected by stored XSS in the artifact directory listing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo...

GHSA-CV78-6M8Q-PH82 Argo Workflows affected by stored XSS in the artifact directory listing

Summary Stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Details The directory listing response in server/artifacts/artifactserver.go...

EUVD-2026-3596

Argo Workflows affected by stored XSS in the artifact directory listing...

Argo Workflows Cross-Site Script Vulnerabilities

Argo Workflows is an open-source, container-native workflow engine for Kubernetes, part of the Argo project. Versions prior to Argo Workflows 3.6.17 and 3.7.8 had a cross-site scripting vulnerability. This vulnerability stemmed from the presence of a stored cross-site script in the artifact...

SUSE CVE-2025-66626

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the...

GO-2025-4223 RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows

RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows...