{"id":"GHSA-rc7p-gmvh-xfx2","aliases":[],"status":"published","title":"Attack on Kubernetes via Misconfigured Argo Workflows","description":"### Impact\n\nUsers running using the Argo Server with `--auth-mode=server` (which is the default \u003c v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.\n\n### Resolution\n\n* Do not expose your user interface to the Internet. \n* Change configuration. `--auth-mode=client`. \n\nFor users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-08-02T17:19:52Z","modified":"2023-01-09T05:04:45Z","fixes":[{"ecosystem":"Go","package":"github.com/argoproj/argo-workflows","fixed_in":["3.0.0"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-workflows","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-workflows","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-rc7p-gmvh-xfx2","tags":["web"]},{"url":"https://www.intezer.com/blog/container-security/new-attacks-on-kubernetes-via-misconfigured-argo-workflows/"},{"url":"https://github.com/advisories/GHSA-rc7p-gmvh-xfx2"},{"url":"https://www.intezer.com/blog/container-security/new-attacks-on-kubernetes-via-misconfigured-argo-workflows","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-rc7p-gmvh-xfx2","title":"Attack on Kubernetes via Misconfigured Argo Workflows","description":"### Impact\n\nUsers running using the Argo Server with `--auth-mode=server` (which is the default \u003c v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.\n\n### Resolution\n\n* Do not expose your user interface to the Internet. \n* Change configuration. `--auth-mode=client`. \n\nFor users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.\n","status":"published","published":"2021-08-02T17:19:52Z","modified":"2023-01-09T05:04:45Z","updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-rc7p-gmvh-xfx2","title":"Attack on Kubernetes via Misconfigured Argo Workflows","description":"### Impact\n\nUsers running using the Argo Server with `--auth-mode=server` (which is the default \u003c v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.\n\n### Resolution\n\n* Do not expose your user interface to the Internet. \n* Change configuration. `--auth-mode=client`. \n\nFor users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.\n","status":"published","published":"2021-08-02T17:19:52Z","modified":"2021-08-02T17:18:32Z","updated_at":"2026-11-02T15:46:55.877614Z"}]}}