Argoproj Argo-workflows vulnerabilities

• argoproj argo-workflows Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector CVE-2026-93991 Fix available 8.3 HighSeptember 19, 2026
• argoproj argo workflows, argo-workflows +1 more Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing CVE-2026-54526 Fix available 8.9 HighJuly 16, 2026
• argoproj argo workflows, argo-workflows +1 more Argo Workflows: Exposure of artifact repository credentials CVE-2026-42295 Fix available 8.5 HighMay 4, 2026
• argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure CVE-2026-42296 Fix available 8.1 HighMay 4, 2026
• argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVE-2026-42294 Fix available 8.2 HighMay 4, 2026
• argoproj argo workflows, argo-workflows +1 more Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) CVE-2026-42183 Fix available 2.3 LowMay 4, 2026
• argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more Argo Workflows Is Missing Authorization in Sync ConfigMap Provider CVE-2026-42297 Fix available 8.5 HighMay 4, 2026
• argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller CVE-2026-40886 Fix available 7.7 HighApril 23, 2026
• argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 more WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode CVE-2026-31892 Fix available 8.9 HighMarch 11, 2026
• argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 more Argo Workflows has unauthorized access to Argo Workflows Template CVE-2026-28229 Fix available 9.8 CriticalMarch 11, 2026
• argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more Argo Workflows affected by stored XSS in the artifact directory listing CVE-2026-23960 Fix available 7.3 HighJanuary 21, 2026
• argoproj argo-workflows, argo workflows +1 more argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links CVE-2025-66626 Fix available 8.1 HighDecember 9, 2025
• argoproj argo workflows, argo-workflows +1 more Argo Workflows exposes artifact repository credentials in workflow-controller logs CVE-2025-62157 Fix available 8.5 HighOctober 14, 2025
• argoproj argo-workflows, argo workflows +1 more argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite CVE-2025-62156 Fix available 8.1 HighOctober 14, 2025
• argoproj argo workflows, argo-workflows +1 more Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode CVE-2024-53862 Fix available 6.3 MediumDecember 2, 2024
• argoproj argo workflows, argo-workflows +1 more Argo Workflows Controller: Denial of Service via malicious daemon Workflows CVE-2024-47827 Fix available 5.7 MediumOctober 28, 2024
• argoproj argo-workflows, argo workflows +1 more Privilege Escalation in argo-workflows CVE-2022-29164 Fix available 7.1 HighMay 5, 2022