github.com/argoproj/argo-workflows/v2 vulnerabilities (Go)
18 vulnerabilities.
-
github.com/argoproj/argo-workflows/v2Go Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing 8.9 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows: Exposure of artifact repository credentials 8.5 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure 8.1 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor 8.2 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) 2.3 Low -
github.com/argoproj/argo-workflows/v2Go Argo Workflows Is Missing Authorization in Sync ConfigMap Provider 8.5 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller 7.7 High -
github.com/argoproj/argo-workflows/v2Go WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode 8.9 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows has unauthorized access to Argo Workflows Template 9.8 Critical -
github.com/argoproj/argo-workflows/v2Go Argo Workflows affected by stored XSS in the artifact directory listing 7.3 High -
github.com/argoproj/argo-workflows/v2Go argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links 8.1 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows exposes artifact repository credentials in workflow-controller logs 8.5 High -
github.com/argoproj/argo-workflows/v2Go argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite 8.1 High -
github.com/argoproj/argo-workflows/v2Go Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode 6.3 Medium -
github.com/argoproj/argo-workflows/v2Go Argo Workflows Controller: Denial of Service via malicious daemon Workflows 5.7 Medium -
github.com/argoproj/argo-workflows/v2Go Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` No score -
github.com/argoproj/argo-workflows/v2Go Argo Server TLS requests could be forged by attacker with network access No score -
github.com/argoproj/argo-workflows/v2Go Workflow re-write vulnerability using input parameter 6.5 Medium