What’s Vulnerable › Vulnerabilities

CVE-2026-23960: Argo Workflows affected by stored XSS in the artifact directory listing

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-21 · updated 2026-07-15
• Weakness: CWE-79

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

Affected products

• argoproj argo-workflows: before 3.6.17; from 3.7.0 before 3.7.8 — fixed in 3.6.17, 3.7.8

How to fix

Upgrade to a fixed version: argoproj argo-workflows 3.6.17, 3.7.8. Check the vendor advisory for mitigations.

References

• https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244
• https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17
• https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17
• https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82
• https://access.redhat.com/security/cve/CVE-2026-23960
• https://bugzilla.redhat.com/show_bug.cgi?id=2431881
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23960.json

Get alerted when CVE-2026-23960 or the next vulnerability affects your stack