GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: bom, grafana-alloy, gitlab-runner, rancher-fleet, trivy-operator, zot, external-secrets-operator-fips, xeol, cerbos-fips, pulumi-kubernetes-operator, chainctl-fips, snyk-cli, packer-fips, dagger, flux-source-controller, pulumi-language-java, argo-cd-fips, packer,...

GHSA-37CH-88JC-XWX2 vulnerabilities

Vulnerabilities for packages: sqlpad, argo-workflows, json-server, kubeflow-katib, kubeflow-pipelines, kubeflow-centraldashboard...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: melange, skaffold, scorecard, trivy, trivy-operator, argo-workflows, snyk-cli, gptscript, flux, gitaly, chezmoi, kaniko, kots, kargo, osv-scanner, gomplate, steampipe, witness, nuclei, crossplane, pulumi-language-yaml, argo-events, apko, bom, kubescape,...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: sqlpad, argo-workflows, json-server, kubeflow-katib, kubeflow-pipelines, kubeflow-centraldashboard...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: melange, skaffold, scorecard, trivy, trivy-operator, argo-workflows, snyk-cli, gptscript, flux, gitaly, chezmoi, kaniko, kots, kargo, osv-scanner, gomplate, steampipe, witness, nuclei, crossplane, pulumi-language-yaml, argo-events, apko, bom, kubescape,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: melange, skaffold, scorecard, trivy, trivy-operator, argo-workflows, snyk-cli, gptscript, flux, gitaly, chezmoi, kaniko, kots, kargo, osv-scanner, gomplate, steampipe, witness, nuclei, crossplane, pulumi-language-yaml, argo-events, apko, bom, kubescape,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: melange, skaffold, scorecard, trivy, trivy-operator, argo-workflows, snyk-cli, gptscript, flux, gitaly, chezmoi, kaniko, kots, kargo, osv-scanner, gomplate, steampipe, witness, nuclei, crossplane, pulumi-language-yaml, argo-events, apko, bom, kubescape,...

Improper Handling Of Symbolic Links

github.com/argoproj/argo-workflows is vulnerable to Improper Handling Of Symbolic Links. The vulnerability is due to flawed validation in the untar process when resolving symbolic links, which allows an attacker to overwrite critical files such as /var/run/argo/argoexec with a malicious script th...

SUSE CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

SUSE CVE-2026-31892

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

GO-2026-4737 Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd

Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd...

GHSA-594F-3595-C47V Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

Summary The terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 "Unexpected session resumption in crypto/tls". Details See https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability. Provider versions starting with v7.15.1 are using go 1.25.8 for buildin...

BIT-ARGO-WORKFLOWS-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

BIT-ARGO-WORKFLOWS-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

GO-2026-4681 Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode in github.com/argoproj/argo-workflows

Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode in github.com/argoproj/argo-workflows...

GO-2026-4678 Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows

Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows...

GHSA-CMV8-6362-R5W9 vulnerabilities

Vulnerabilities for packages: argo-workflows...

CVE-2022-29164 vulnerabilities

Vulnerabilities for packages: argo-workflows...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the podSpecPatch when including a podSpecPatch field in their Workflow submission. An attacker can override security restrictions defined in approved templates by submitting a workflow that includes a crafted...

EUVD-2026-11206

Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode...