GHSA-rc7p-gmvh-xfx2
Attack on Kubernetes via Misconfigured Argo Workflows
Impact
Users running using the Argo Server with --auth-mode=server (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.
Resolution
- Do not expose your user interface to the Internet.
- Change configuration.
--auth-mode=client.
For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.
What each source reports
GitHub AdvisoriesNo score
Attack on Kubernetes via Misconfigured Argo Workflows
Impact
Users running using the Argo Server with --auth-mode=server (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.
Resolution
- Do not expose your user interface to the Internet.
- Change configuration.
--auth-mode=client.
For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.
- Record
GHSA-rc7p-gmvh-xfx2- Updated
- 2026-11-02
OSVNo score
Attack on Kubernetes via Misconfigured Argo Workflows
Impact
Users running using the Argo Server with --auth-mode=server (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.
Resolution
- Do not expose your user interface to the Internet.
- Change configuration.
--auth-mode=client.
For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.
- Record
GHSA-rc7p-gmvh-xfx2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-workflowsGo | before 3.0.0 | 3.0.0 |
github.com/argoproj/argo-workflowsGo | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-rc7p-gmvh-xfx2 is a vulnerability with no CVSS score yet in github.com/argoproj/argo-workflows, published August 2, 2021. No source lists public exploit code. Fixed in github.com/argoproj/argo-workflows 3.0.0.