690 matches found
PT-2026-42354
Multiple security vulnerabilities affect the argo-workflows package. These issues are resolved in later releases. See references for individual vulnerability details...
CVE-2026-4867 vulnerabilities
Vulnerabilities for packages: argo-workflows, arangodb, py3-captum, wazuh-dashboard-fips, kubeflow-katib, sqlpad, thingsboard-fips, kubeflow-centraldashboard, gitlab-rails-ce-fips, pelias-api, wazuh-dashboard, gitlab-rails-ce, langfuse, json-server, kubescape-grype-offline-db, langfuse-fips,...
GHSA-JHF3-XXHW-2WPP vulnerabilities
Vulnerabilities for packages: trivy-operator, amazon-ssm-agent-fips, packer, pulumi, melange, chainctl, scorecard, gitsign, trufflehog, crossplane, grype-db, apko, k9s-fips, flux-fips, pulumi-kubernetes-operator, cerbos-fips, skaffold, argo-cd, gitlab-rails-ce, rancher-fleet, tfsec, syft,...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: trivy-operator, amazon-ssm-agent-fips, packer, pulumi, melange, chainctl, scorecard, gitsign, trufflehog, crossplane, grype-db, apko, k9s-fips, flux-fips, pulumi-kubernetes-operator, cerbos-fips, skaffold, argo-cd, gitlab-rails-ce, rancher-fleet, tfsec, syft,...
GHSA-37CH-88JC-XWX2 vulnerabilities
Vulnerabilities for packages: argo-workflows, arangodb, py3-captum, wazuh-dashboard-fips, kubeflow-katib, sqlpad, thingsboard-fips, kubeflow-centraldashboard, gitlab-rails-ce-fips, pelias-api, wazuh-dashboard, gitlab-rails-ce, langfuse, json-server, kubescape-grype-offline-db, langfuse-fips,...
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: trivy-operator, amazon-ssm-agent-fips, packer, pulumi, melange, chainctl, scorecard, gitsign, trufflehog, crossplane, grype-db, apko, k9s-fips, flux-fips, pulumi-kubernetes-operator, cerbos-fips, skaffold, argo-cd, gitlab-rails-ce, rancher-fleet, tfsec, syft,...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: trivy-operator, amazon-ssm-agent-fips, packer, pulumi, melange, chainctl, scorecard, gitsign, trufflehog, crossplane, grype-db, apko, k9s-fips, flux-fips, pulumi-kubernetes-operator, cerbos-fips, skaffold, argo-cd, gitlab-rails-ce, rancher-fleet, tfsec, syft,...
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: kubescape, k9s, tfsec, witness, flux-source-controller, skaffold, trivy-operator, bom, kots, gitsign, dagger, trufflehog, zarf, flux, pulumi-language-dotnet, grafana-alloy, scorecard, snyk-cli, cerbos, osv-scanner, teleport, grype, kaniko, gitaly, wolfictl,...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: kubescape, k9s, tfsec, witness, flux-source-controller, skaffold, trivy-operator, bom, kots, gitsign, dagger, trufflehog, zarf, flux, pulumi-language-dotnet, grafana-alloy, scorecard, snyk-cli, cerbos, osv-scanner, teleport, grype, kaniko, gitaly, wolfictl,...
GHSA-JHF3-XXHW-2WPP vulnerabilities
Vulnerabilities for packages: kubescape, k9s, tfsec, witness, flux-source-controller, skaffold, trivy-operator, bom, kots, gitsign, dagger, trufflehog, zarf, flux, pulumi-language-dotnet, grafana-alloy, scorecard, snyk-cli, cerbos, osv-scanner, teleport, grype, kaniko, gitaly, wolfictl,...
GHSA-37CH-88JC-XWX2 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, kubeflow-centraldashboard, json-server, kubeflow-katib, sqlpad, argo-workflows...
CVE-2026-4867 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, kubeflow-centraldashboard, json-server, kubeflow-katib, sqlpad, argo-workflows...
Improper Handling Of Symbolic Links
github.com/argoproj/argo-workflows is vulnerable to Improper Handling Of Symbolic Links. The vulnerability is due to flawed validation in the untar process when resolving symbolic links, which allows an attacker to overwrite critical files such as /var/run/argo/argoexec with a malicious script th...
SUSE CVE-2026-28229
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...
SUSE CVE-2026-31892
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...
BIT-ARGO-WORKFLOWS-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...
BIT-ARGO-WORKFLOWS-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...
GO-2026-4678 Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows
Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows...
GO-2026-4681 Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode in github.com/argoproj/argo-workflows
Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode in github.com/argoproj/argo-workflows...