GHSA-prqf-xr2j-xf65
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`
Impact
This is pro-active fix. No know exploits exist.
Impacted:
- You're running Kubernetes >= v1.19
- You're running Argo Server
- It is configured to with
--auth-mode=client - Is not configured with
--auth-mode=server - You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.
- You're using client key to authenticate on the server.
- The server has more permissions that the connecting client's account.
The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.
Patches
https://github.com/argoproj/argo-workflows/pull/6506
Workarounds
None.
What each source reports
GitHub AdvisoriesNo score
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`
Impact
This is pro-active fix. No know exploits exist.
Impacted:
- You're running Kubernetes >= v1.19
- You're running Argo Server
- It is configured to with
--auth-mode=client - Is not configured with
--auth-mode=server - You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.
- You're using client key to authenticate on the server.
- The server has more permissions that the connecting client's account.
The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.
Patches
https://github.com/argoproj/argo-workflows/pull/6506
Workarounds
None.
- Record
GHSA-prqf-xr2j-xf65- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVNo score
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`
Impact
This is pro-active fix. No know exploits exist.
Impacted:
- You're running Kubernetes >= v1.19
- You're running Argo Server
- It is configured to with
--auth-mode=client - Is not configured with
--auth-mode=server - You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.
- You're using client key to authenticate on the server.
- The server has more permissions that the connecting client's account.
The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.
Patches
https://github.com/argoproj/argo-workflows/pull/6506
Workarounds
None.
- Record
GHSA-prqf-xr2j-xf65- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVGO-2022-0405No score
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with --auth-mode=client in github.com/argoproj/argo-workflows
- Record
GO-2022-0405- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-workflows/v3Go | 3.0.0 up to 3.0.9 | 3.0.9 |
github.com/argoproj/argo-workflows/v3Go | 3.1.0 up to 3.1.6 | 3.1.6 |
github.com/argoproj/argo-workflowsGo | All versions | None known |
github.com/argoproj/argo-workflows/v2Go | All versions | None known |
github.com/argoproj/argo-workflows/v3Go | 3.0.0 up to 3.0.9, 3.1.0 up to 3.1.6 | 3.0.93.1.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-prqf-xr2j-xf65 is a vulnerability with no CVSS score yet in github.com/argoproj/argo-workflows, published August 23, 2021. No source lists public exploit code. Fixed in github.com/argoproj/argo-workflows/v3 3.0.9.