—Go
GO-2026-5751· BIT-argo-workflows-2026-42297, CVE-2026-42297Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows
Modified: 7/2/2026
package
Go/github.com/argoproj/argo-workflows
pkg:go/github.com/argoproj/argo-workflows
HIGHGo
GHSA-3wf5-g532-rcrr· BIT-argo-workflows-2026-31892, CVE-2026-31892Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Modified: 9/10/2026
HIGHGo
GHSA-48p8-g2fx-3wwm· BIT-argo-workflows-2026-54526, CVE-2026-54526Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
Modified: 9/10/2026
HIGHGo
GHSA-cv78-6m8q-ph82· BIT-argo-workflows-2026-23960, CVE-2026-23960Argo Workflows affected by stored XSS in the artifact directory listing
Modified: 9/10/2026
MEDIUMGo
GHSA-rc7p-gmvh-xfx2Attack on Kubernetes via Misconfigured Argo Workflows
Modified: 8/2/2021
HIGH8.1Go
GHSA-xrqc-7xgx-c9vh· BIT-argo-workflows-2025-66626, CVE-2025-66626RCE via ZipSlip and symbolic links in argoproj/argo-workflows
Modified: 9/10/2026
—Go
GO-2022-0388· GHSA-6c73-2v8x-qpvmArgo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows
Modified: 3/3/2026
—Go
GO-2022-0405· GHSA-prqf-xr2j-xf65Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows
Modified: 3/3/2026
—Go
GO-2022-0928· BIT-argo-workflows-2021-37914, CVE-2021-37914Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows
Modified: 3/3/2026
—Go
GO-2024-3226· BIT-argo-workflows-2024-47827, CVE-2024-47827Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows
Modified: 3/3/2026
—Go
GO-2024-3303· BIT-argo-workflows-2024-53862, CVE-2024-53862Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows
Modified: 2/4/2026
—Go
GO-2025-4023· BIT-argo-workflows-2025-62156, CVE-2025-62156Argo Workflow has a Zipslip Vulnerability in github.com/argoproj/argo-workflows
Modified: 2/4/2026
—Go
GO-2025-4024· BIT-argo-workflows-2025-62157, CVE-2025-62157Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows
Modified: 2/4/2026
—Go
GO-2025-4223· BIT-argo-workflows-2025-66626, CVE-2025-66626RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows
Modified: 2/4/2026
—Go
GO-2026-4350· BIT-argo-workflows-2026-23960, CVE-2026-23960Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows
Modified: 2/4/2026
—Go
GO-2026-4678· BIT-argo-workflows-2026-28229, CVE-2026-28229Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows
Modified: 3/23/2026
—Go
GO-2026-4681· BIT-argo-workflows-2026-31892, CVE-2026-31892Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode in github.com/argoproj/argo-workflows
Modified: 3/23/2026
—Go
GO-2026-5072· BIT-argo-workflows-2026-42296, CVE-2026-42296Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows
Modified: 6/25/2026
—Go
GO-2026-5148· BIT-argo-workflows-2026-40886, CVE-2026-40886Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows
Modified: 6/26/2026
—Go
GO-2026-5235· BIT-argo-workflows-2026-42295, CVE-2026-42295Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows
Modified: 7/2/2026
—Go
GO-2026-5462· BIT-argo-workflows-2026-42294, CVE-2026-42294Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows
Modified: 6/25/2026
—Go
GO-2026-5527· BIT-argo-workflows-2026-42183, CVE-2026-42183Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows
Modified: 7/2/2026
—Go
GO-2026-6223· BIT-argo-workflows-2026-54526, CVE-2026-54526Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) in github.com/argoproj/argo-workflows
Modified: 8/18/2026