What’s Vulnerable › Products
argoproj argo-workflows vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.
Check whether your argoproj argo-workflows version is affected
Latest argoproj argo-workflows vulnerabilities
- CVE-2026-93991 — Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector (CVSS 7.7)
- CVE-2026-54526 — Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing (CVSS 9.9)
- CVE-2026-42297 — Argo Workflows Is Missing Authorization in Sync ConfigMap Provider (CVSS 8.3)
- CVE-2026-42296 — Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure (CVSS 8.1)
- CVE-2026-42295 — Argo Workflows: Exposure of artifact repository credentials (CVSS 4.9)
- CVE-2026-42294 — Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor (CVSS 7.5)
- CVE-2026-42183 — Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) (CVSS 6.5)
- CVE-2026-40886 — Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller (CVSS 7.7)
- CVE-2026-31892 — WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode (CVSS 8.1)
- CVE-2026-28229 — Argo Workflows has unauthorized access to Argo Workflows Template (CVSS 7.5)
- CVE-2026-23960 — Argo Workflows affected by stored XSS in the artifact directory listing (CVSS 5.4)
- CVE-2025-66626 — argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links (CVSS 7.5)
- CVE-2025-62157 — Argo Workflows exposes artifact repository credentials in workflow-controller logs (CVSS 6.5)
- CVE-2025-62156 — argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite (CVSS 8.8)
- CVE-2024-53862 — Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode (CVSS 7.5)
- CVE-2024-47827 — Argo Workflows Controller: Denial of Service via malicious daemon Workflows (CVSS 4.8)
- CVE-2022-29164 — Privilege Escalation in argo-workflows (CVSS 7.1)
- CVE-2021-37914 — (CVSS 6.5)