Missing Authorization

github.com/argoproj/argo-workflows is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks in the Sync Service's ConfigMap-backed provider, which allows an attacker to create, read, update, and delete synchronization-related Kubernetes ConfigMaps without...

CVE-2026-44973 vulnerabilities

Vulnerabilities for packages: syft-fips, cerbos-fips, seaweedfs-rocksdb-fips, seaweedfs-rocksdb, kyverno-fips, rclone, rancher-fleet, scorecard, amazon-ssm-agent, gitlab-rails-ce, telegraf, flux, terragrunt, argo-cd-fips, nemo, grafana-fips, gitaly, teleport, flux-fips,...

GHSA-QW64-3X98-G7Q2 vulnerabilities

Vulnerabilities for packages: syft-fips, cerbos-fips, seaweedfs-rocksdb-fips, seaweedfs-rocksdb, kyverno-fips, rclone, rancher-fleet, scorecard, amazon-ssm-agent, gitlab-rails-ce, telegraf, flux, terragrunt, argo-cd-fips, nemo, grafana-fips, gitaly, teleport, flux-fips,...

Information Disclosure

Argo CD is vulnerable to Information Exposure. The vulnerability is due to missing authorization and insufficient data masking in the ServerSideDiff endpoint, which allows an attacker with read-only access to extract plaintext Kubernetes Secret data through the Server-Side Apply dry-run mechanism...

CVE-2026-45738

creationtimestamp| type| source ---|---|--- 2026-05-13 17:59:47+00:00| published-proof-of-concept| https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38...

CVE-2026-45737

creationtimestamp| type| source ---|---|--- 2026-05-13 17:57:01+00:00| published-proof-of-concept| https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp...

PT-2026-40844

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 3.2.12 Argo CD versions prior to 3.3.10 Argo CD versions prior to 3.4.2 Description A stored cross-site scripting XSS issue exists in the application Summary tab. A user with application write access developer role ca...

BIT-ARGO-WORKFLOWS-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

BIT-ARGO-WORKFLOWS-2026-42296 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

BIT-ARGO-WORKFLOWS-2026-42295 Argo Workflows: Exposure of artifact repository credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

BIT-ARGO-WORKFLOWS-2026-42294 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

BIT-ARGO-WORKFLOWS-2026-42183 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: melange, apko, grype, snyk-cli, kots, pulumi-language-java, skaffold, syft, osv-scanner, dagger, gomplate, pulumi-language-dotnet, trufflehog, zot, tfsec, pulumi-kubernetes-operator, gitlab-runner, goreleaser, bom, zarf, gptscript, wolfictl, gitaly, nfpm, kubevela,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: melange, apko, grype, snyk-cli, kots, pulumi-language-java, skaffold, syft, osv-scanner, dagger, gomplate, pulumi-language-dotnet, trufflehog, zot, tfsec, pulumi-kubernetes-operator, gitlab-runner, goreleaser, bom, zarf, gptscript, wolfictl, gitaly, nfpm, kubevela,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: syft-fips, witness, grafana-alloy, rancher-fleet, nuclei, scorecard, tfsec, gitlab-rails-ce, trufflehog-fips, apko, pulumi-language-yaml, flux, gitaly, jfrog-cli, teleport, flux-fips, gitaly-fips, grype-fips, google-osconfig-agent, crossplane, grype, packer, syft,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: syft-fips, witness, grafana-alloy, rancher-fleet, nuclei, scorecard, tfsec, gitlab-rails-ce, trufflehog-fips, apko, pulumi-language-yaml, flux, gitaly, jfrog-cli, teleport, flux-fips, gitaly-fips, grype-fips, google-osconfig-agent, crossplane, grype, packer, syft,...

PT-2026-40270

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

PT-2026-40269

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

PT-2026-40272

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

PT-2026-40273

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/sync cm.go performs zero authorization checks on all CRUD operations create, read,...