Argo workflows

This hub aggregates every CVE we track for Argo workflows, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Argo workflows.

• CVE-2026-54526Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing9.9Jul 16, 2026
• CVE-2026-42296Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure8.1May 9, 2026
• CVE-2026-42295Argo Workflows: Exposure of artifact repository credentials4.9May 9, 2026
• CVE-2026-42294Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor7.5May 9, 2026
• CVE-2026-42183Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)6.5May 9, 2026
• CVE-2026-42297Argo Workflows Is Missing Authorization in Sync ConfigMap Provider8.3May 9, 2026
• CVE-2026-40886Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller7.7Apr 23, 2026
• CVE-2026-31892WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode8.1Mar 11, 2026
• CVE-2026-28229Argo Workflows has unauthorized access to Argo Workflows Template9.8Mar 11, 2026
• CVE-2026-23960Argo Workflows affected by stored XSS in the artifact directory listing5.4Jan 21, 2026
• CVE-2025-66626argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links8.1Dec 9, 2025
• CVE-2025-62157Argo Workflows exposes artifact repository credentials in workflow-controller logs6.5Oct 14, 2025
• CVE-2025-62156argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite8.1Oct 14, 2025
• CVE-2024-53862Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode7.5Dec 2, 2024
• CVE-2024-47827Argo Workflows Controller: Denial of Service via malicious daemon Workflows5.7Oct 28, 2024