CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

PT-2026-95875

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.1.0 through 4.1.3 Description An authorization bypass exists in the ListArchivedWorkflows function. The issue occurs when the metadata.namespace field selector utilizes the NotEquals operator, causing a failure to app...

CVE-2026-93991: Authorization Bypass Through User-Controlled Key

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: buildah-fips, argo-cd, kubescape-operator-fips, argo-workflows, crossplane-provider-gcp-beta-cloudplatform-fips, beats, redis-operator, longhorn-manager-fips, gitlab-cng-fips, crossplane-provider-kubernetes, teleport-operator-fips, sops, kyverno-notation-aws-fips,...

GHSA-8WMF-6V46-5GFG vulnerabilities

Vulnerabilities for packages: buildah-fips, argo-cd, kubescape-operator-fips, argo-workflows, crossplane-provider-gcp-beta-cloudplatform-fips, beats, redis-operator, longhorn-manager-fips, gitlab-cng-fips, crossplane-provider-kubernetes, teleport-operator-fips, sops, kyverno-notation-aws-fips,...

CLEANSTART-2026-LB77513 Security fix for CVE-2025-62156 applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NK14578 Security fix for CVE-2025-62157 applied in: argo-workflows-fips 3.7.3-r0

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2025-WY26616 Security fix for CVE-2025-32445 applied in: argo-workflows-fips 3.5.15-r1

Security vulnerability affects the argo-workflows-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UC71482 Security fix for CVE-2025-8556 applied in: argo-workflows-fips 3.5.15-r1, argo-workflows-fips 3.6.13-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, policy-controller 0.12.1-r1

CVE-2025-8556 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MJ31309 Security fix for CVE-2026-25934 applied in: argo-cd 3.0.23-r0, argo-cd-fips 3.0.22-r1, argo-cd-fips 3.1.11-r0, argo-cd-fips 3.1.12-r1, argo-cd-fips 3.2.5-r0, argo-cd-fips 3.2.7-r0, argo-workflows 3.6.17-r0, argo-workflows 3.6.18-r0, argo-workflows 3.7.7-r0, argo-workflows 3.7.8-r0, argo-workflows 3.7.9-r0, argo-workflows-fips 3.6.16-r0, argo-workflows-fips 3.6.17-r1, argo-workflows-fips 3.6.18-r0, argo-workflows-fips 3.7.9-r0, argo-workflows-fips 3.7.9-r1, external-secrets 0.20.4-r0, external-secrets-fips 0.17.0-r2, external-secrets-fips 0.20.4-r2, flux-image-automation-controller-fips 4.0.1-r0, gptscript 0.9.8-r0, gptscript 0.9.9-r0, grafana-alloy 1.13.1-r0, grafana-alloy 1.13.2-r0, kubescape 3.0.47-r0, kubevela 1.10.8-r0, pulumi-kubernetes-operator 1.16.0-r0, syft 1.39.0-r0, timoni 0.25.2-r0

CVE-2026-25934 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RC77081 Security fix for CVE-2026-26996 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, npm 11.10.0-r1, opensearch-dashboards-fips 3.5.0-r2, renovate 43.4.3-r1, renovate 43.4.4-r0

CVE-2026-26996 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JJ50819 Security fix for CVE-2025-15558 applied in: argo-workflows 3.7.10-r4, argo-workflows 3.7.7-r0, argo-workflows 4.0.2-r0, argo-workflows-fips 3.6.19-r1, argo-workflows-fips 3.7.10-r2, argo-workflows-fips 4.0.2-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, crossplane 2.0.2-r1, dynatrace-operator 1.8.1-r3, flux-image-automation-controller-fips 4.0.1-r0, gptscript 0.6.0-r0, gptscript 0.7.1-r0, gptscript 0.8.5-r0, gptscript 0.9.8-r0, harbor 2.13.4-r1, harbor-fips 2.13.4-r0, harbor-fips 2.14.2-r1, harbor-scanner-trivy 0.35.1-r0, harbor-scanner-trivy-fips 0.35.1-r0, istio 1.27.1-r0, istio 1.28.4-r0, istio 1.28.5-r2, istio 1.28.7-r2, istio 1.29.0-r0, istio 1.29.1-r1, istio-fips 1.25.5-r4, istio-fips 1.27.8-r2, istio-fips 1.28.5-r2, istio-fips 1.29.1-r1, istio-pilot-discovery-fips 1.28.3-r1, kubescape 3.0.47-r1, kubevela 1.10.8-r0, kyverno-fips 1.13.6-r9, kyverno-fips 1.16.1-r3, kyverno-fips 1.16.3-r3, kyverno-fips 1.17.1-r2, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r7, minio-operator 7.0.1-r5, minio-operator-fips 5.0.18-r8, paranoia 0.2.1-r0, paranoia 0.3.1-r0, paranoia 0.4.0-r0, policy-controller 0.12.1-r1, rancher-agent 2.11.15-r1, spire-server 1.13.5-r0, syft 1.39.0-r2, tekton-chains 0.26.0-r3, tekton-pipelines 1.7.0-r0, tekton-pipelines 1.9.2-r0, tekton-pipelines-fips 1.10.2-r0, tekton-pipelines-fips 1.11.0-r0, tekton-pipelines-fips 1.7.0-r0, tekton-pipelines-fips 1.9.2-r0, timoni 0.25.2-r0, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn-fips 0.43.0-r4

CVE-2025-15558 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BE82466 Security fix for CVE-2026-32141 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, renovate 43.4.3-r1, renovate 43.4.4-r0

CVE-2026-32141 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NS67921 Security fix for CVE-2025-69873 applied in: argo-workflows 3.6.19-r8, mongosh 2.5.10-r5, mongosh 2.6.0-r4, opensearch-dashboards-fips 2.19.5-r0, opensearch-dashboards-fips 3.5.0-r2, renovate 43.4.3-r1, renovate 43.4.4-r0

CVE-2025-69873 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HA54689 Security fix for CVE-2026-27904 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, npm 11.11.0-r0, opensearch-dashboards-fips 3.5.0-r2, renovate 43.4.3-r1, renovate 43.4.4-r0

CVE-2026-27904 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PF59420 Security fix for CVE-2026-33895 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, jitsucom-jitsu 2.11.0-r3, opensearch-dashboards-fips 2.19.5-r0

CVE-2026-33895 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DH07747 Security fix for CVE-2026-33896 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, jitsucom-jitsu 2.11.0-r3, opensearch-dashboards-fips 2.19.5-r0

CVE-2026-33896 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AG97190 Security fix for CVE-2026-33891 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, jitsucom-jitsu 2.11.0-r3, opensearch-dashboards-fips 2.19.5-r0

CVE-2026-33891 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZI53736 Security fix for CVE-2026-33894 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, jitsucom-jitsu 2.11.0-r3, opensearch-dashboards-fips 2.19.5-r0

CVE-2026-33894 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...