HIGH8.1Go
GHSA-3775-99mw-8rp4· BIT-argo-workflows-2026-42296, CVE-2026-42296Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
Modified: 6/25/2026
package
Go/github.com/argoproj/argo-workflows/v4
pkg:go/github.com/argoproj/argo-workflows/v4
HIGHGo
GHSA-3wf5-g532-rcrr· BIT-argo-workflows-2026-31892, CVE-2026-31892Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Modified: 9/10/2026
HIGHGo
GHSA-48p8-g2fx-3wwm· BIT-argo-workflows-2026-54526, CVE-2026-54526Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
Modified: 9/10/2026
HIGH7.5Go
GHSA-56px-hm34-xqj5· BIT-argo-workflows-2026-28229, CVE-2026-28229Unauthorized access to Argo Workflows Template
Modified: 9/10/2026
HIGH7.7Go
GHSA-5jv8-h7qh-rf5p· BIT-argo-workflows-2026-40886, CVE-2026-40886Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller
Modified: 9/10/2026
HIGHGo
GHSA-7vf8-2cr6-54mf· BIT-argo-workflows-2026-42295, CVE-2026-42295Argo vulnerable to exposure of artifact repository credentials
Modified: 9/10/2026
HIGH7.5Go
GHSA-jcc8-g2q4-9fxq· BIT-argo-workflows-2026-42294, CVE-2026-42294Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Modified: 7/21/2026
LOWGo
GHSA-p4gq-3vxj-f4jq· BIT-argo-workflows-2026-42183, CVE-2026-42183Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Modified: 9/10/2026
HIGHGo
GHSA-xchc-cqwg-g76q· BIT-argo-workflows-2026-42297, CVE-2026-42297Argo has Missing Authorization in its Sync ConfigMap Provider
Modified: 9/10/2026
—Go
GO-2026-4678· BIT-argo-workflows-2026-28229, CVE-2026-28229Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows
Modified: 3/23/2026
—Go
GO-2026-4681· BIT-argo-workflows-2026-31892, CVE-2026-31892Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode in github.com/argoproj/argo-workflows
Modified: 3/23/2026
—Go
GO-2026-5072· BIT-argo-workflows-2026-42296, CVE-2026-42296Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows
Modified: 6/25/2026
—Go
GO-2026-5148· BIT-argo-workflows-2026-40886, CVE-2026-40886Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows
Modified: 6/26/2026
—Go
GO-2026-5235· BIT-argo-workflows-2026-42295, CVE-2026-42295Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows
Modified: 7/2/2026
—Go
GO-2026-5462· BIT-argo-workflows-2026-42294, CVE-2026-42294Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows
Modified: 6/25/2026
—Go
GO-2026-5527· BIT-argo-workflows-2026-42183, CVE-2026-42183Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows
Modified: 7/2/2026
—Go
GO-2026-5751· BIT-argo-workflows-2026-42297, CVE-2026-42297Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows
Modified: 7/2/2026
—Go
GO-2026-6223· BIT-argo-workflows-2026-54526, CVE-2026-54526Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) in github.com/argoproj/argo-workflows
Modified: 8/18/2026