Unauthorized access to Argo Workflows Template

Summary Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. Details...

PT-2026-24700

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 4.0.2 and 3.7.11 Description Argo Workflows, an open source container-native workflow engine for Kubernetes, has an issue where Workflow templates endpoints allow any client to retrieve WorkflowTemplates and...

CVE-2026-28229: Incorrect Authorization

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

Argo Workflows 安全漏洞

Argo Workflows is an open-source, container-native workflow engine for Kubernetes, part of the Argo project. Versions prior to Argo Workflows 4.0.2 and 3.7.11 contained security vulnerabilities. These vulnerabilities stemmed from the workflow template endpoints, which allowed any client to access...

CVE-2026-31892: Incorrect Authorization

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

PT-2026-24701

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 2.9.0 through 4.0.1 Argo Workflows version 3.7.11 Description Argo Workflows is a container-native workflow engine for Kubernetes. A user who can submit Workflows can bypass security settings defined in a WorkflowTempla...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions prior to Argo Workflows 4.0.2 and 3.7.11 contained security vulnerabilities. These vulnerabilities stemmed from the ability for users to bypass all security settings in the...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns-fips, kubernetes-event-exporter-fips, crossplane-provider-aws-iam, step-kms-plugin, prometheus-elasticsearch-exporter, chaos-mesh, plugin-barman-cloud, kserve, aws-flb-cloudwatch-fips, cue-fips, jobset, kpt, kyverno,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: controller-gen, crossplane-provider-aws-sns-fips, cluster-api-ipam-provider-in-cluster, kubernetes-event-exporter-fips, crossplane-provider-aws-iam, step-kms-plugin, prometheus-elasticsearch-exporter, chaos-mesh, kubecolor, plugin-barman-cloud, kserve,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: controller-gen, crossplane-provider-aws-sns-fips, cluster-api-ipam-provider-in-cluster, kubernetes-event-exporter-fips, crossplane-provider-aws-iam, step-kms-plugin, prometheus-elasticsearch-exporter, chaos-mesh, plugin-barman-cloud, kserve, aws-flb-cloudwatch-fips,...

GHSA-WF6X-7X77-MVGW vulnerabilities

Vulnerabilities for packages: vitess, kubeflow-katib, argo-workflows, rancher-api-ui...

CVE-2026-29063 vulnerabilities

Vulnerabilities for packages: vitess, kubeflow-katib, argo-workflows, rancher-api-ui...

CVE-2026-29063 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-katib, gitlab-rails-ce, rancher-api-ui, vitess, gitlab-rails-ce-fips, arangodb, authentik, authentik-fips...

GHSA-WF6X-7X77-MVGW vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-katib, gitlab-rails-ce, rancher-api-ui, vitess, gitlab-rails-ce-fips, arangodb, authentik, authentik-fips...

Before You Hand over the Wheel: Evaluating LLMs for Security Incident Analysis

Security incident analysis SIA poses a major challenge for security operations centers, which must manage overwhelming alert volumes, large and diverse data sources, complex toolchains, and limited analyst expertise. These difficulties intensify because incidents evolve dynamically and require...

Malicious AI Assistant Extensions Harvest LLM Chat Histories

Microsoft Defender has been investigating reports of malicious Chromium‑based browser extensions that impersonate legitimate AI assistant tools to harvest LLM chat histories and browsing data. Reporting indicates these extensions have reached approximately 900,000 installs. Microsoft Defender...

How to Avoid Confidentiality Gaps in Early-Stage Startups

Startups often expose sensitive data during pitches and hiring. Learn when to use NDAs and simple workflows to close confidentiality gaps...

BIT-KIBANA-2026-26938 Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

Improper Neutralization of Special Elements Used in a Template Engine CWE-1336 exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery SSRF via Code Injection CAPEC-242. This requires an...

BIT-ELK-2026-26938 Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

Improper Neutralization of Special Elements Used in a Template Engine CWE-1336 exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery SSRF via Code Injection CAPEC-242. This requires an...

CLEANSTART-2026-BY85815 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Multiple security vulnerabilities affect the argo-workflows package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...