GoPackage

github.com/argoproj/argo-workflows

16 known vulnerabilities (1 critical, 11 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: v2.5.2+incompatible (Feb 24, 2020): affected by 16 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 16 · 1 critical, 11 high, 2 medium, 1 low

Releases: 500+ since v2.3.0+incompatible (May 20, 2019)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-54526
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-42296
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-42295
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-42294
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-42183
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-42297
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-40886
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-31892
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-28229
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2026-23960
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2025-66626
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2025-62157
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)

Show all 16 advisoriesShow fewer advisories

CVE-2025-62156
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2024-53862
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2024-47827
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)
CVE-2021-37914
Affects v2.2.2-0.20190315175059-b2743f30c411+incompatible to v2.5.3-rc4.0.20200224230055-d154b0bc595f+incompatible (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 16

CVE-2026-54526High 8.9
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Affected: all versions; through 2.5.3-rc4.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-42296High 8.1
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing…
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-42295High 8.5
Argo Workflows: Exposure of artifact repository credentials
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-42294High 8.2
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-42183Low 2.3
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-42297High 8.5
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-40886High 7.7
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-31892High 8.9
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Affected: all versions; from 2.9.0.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-28229Critical 9.8
Argo Workflows has unauthorized access to Argo Workflows Template
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2026-23960High 7.3
Argo Workflows affected by stored XSS in the artifact directory listing
Affected: all versions; through 2.5.3-rc4.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2025-66626High 8.1
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Affected: all versions; through 2.5.3-rc4.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2025-62157High 8.5
Argo Workflows exposes artifact repository credentials in workflow-controller logs
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2025-62156High 8.1
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2024-53862Medium 6.3
Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2024-47827Medium 5.7
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.
CVE-2021-37914Unrated
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when…
Affected: all versions.
No fix released. The latest release, v2.5.2+incompatible, is still affected.