- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 16 · 1 critical, 11 high, 2 medium, 1 low
- Registry
- pkg.go.dev
Advisories 16
- CVE-2026-54526High 8.9
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Affected: all versions.
- CVE-2026-42296High 8.1
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing…
Affected: all versions.
- CVE-2026-42295High 8.5
Argo Workflows: Exposure of artifact repository credentials
Affected: all versions.
- CVE-2026-42294High 8.2
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Affected: all versions.
- CVE-2026-42183Low 2.3
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Affected: all versions.
- CVE-2026-42297High 8.5
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Affected: all versions.
- CVE-2026-40886High 7.7
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
Affected: all versions.
- CVE-2026-31892High 8.9
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Affected: from 2.9.0.
- CVE-2026-28229Critical 9.8
Argo Workflows has unauthorized access to Argo Workflows Template
Affected: all versions.
- CVE-2026-23960High 7.3
Argo Workflows affected by stored XSS in the artifact directory listing
Affected: all versions.
- CVE-2025-66626High 8.1
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Affected: all versions.
- CVE-2025-62157High 8.5
Argo Workflows exposes artifact repository credentials in workflow-controller logs
Affected: all versions.
- CVE-2025-62156High 8.1
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
Affected: all versions.
- CVE-2024-53862Medium 6.3
Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode
Affected: all versions.
- CVE-2024-47827Medium 5.7
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Affected: all versions.
- CVE-2021-37914Unrated
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when…
Affected: all versions.