CVE-2021-37914
Workflow re-write vulnerability using input parameter
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
- Record
CVE-2021-37914- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
- Record
CVE-2021-37914- Updated
- 2026-11-02
EUVDEUVD-2021-1738 No score
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
- Record
EUVD-2021-1738- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h563-xh25-x54q No score
Workflow re-write vulnerability using input parameter
Impact
- Allow end-users to set input parameters, but otherwise expect workflows to be secure.
Patches
Not yet.
Workarounds
- Set
EXPRESSION_TEMPLATES=falsefor the workflow controller
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in example link to repo
- Email us at example email address
- Record
GHSA-h563-xh25-x54q- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
- Record
CVE-2021-37914- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVBIT-argo-workflows-2021-37914 No score
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
- Record
BIT-argo-workflows-2021-37914- Updated
- 2026-11-02
OSVGHSA-h563-xh25-x54q No score
Workflow re-write vulnerability using input parameter
Impact
- Allow end-users to set input parameters, but otherwise expect workflows to be secure.
Patches
Not yet.
Workarounds
- Set
EXPRESSION_TEMPLATES=falsefor the workflow controller
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in example link to repo
- Email us at example email address
- Record
GHSA-h563-xh25-x54q- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGO-2022-0928 No score
Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows
Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows
- Record
GO-2022-0928- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-workflows/v3Go |
3.1.0 up to 3.1.6 | 3.1.6 |
argo-workflowsBitnami |
before 3.1.4 | 3.1.4 |
github.com/argoproj/argo-workflowsGo |
All versions | None known |
github.com/argoproj/argo-workflows/v2Go |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37914 is a medium vulnerability (CVSS 6.5) in Argoproj Argo Workflows, published August 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in github.com/argoproj/argo-workflows/v3 3.1.6.
References
github.com/argoproj/argo-workflows/issues/6441
nvd.nist.gov/vuln/detail/CVE-2021-37914