GoPackage

github.com/argoproj/argo-workflows/v4

9 known vulnerabilities (1 critical, 7 high, 1 low), with the versions each affects and the releases that fix them.

Latest release: v4.1.6 (Oct 22, 2026): no advisory affects it
Newest unaffected release: v4.1.6 (Oct 22, 2026), the latest release
Advisories: 9 · 1 critical, 7 high, 1 low

Releases: 23 since v4.0.2 (Mar 11, 2026)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-54526
Affects v4.0.2 to v4.0.5 (v4.0.6 is outside it)
CVE-2026-42296
Affects v4.0.2 to v4.0.4 (v4.0.5 is outside it)
CVE-2026-42295
Affects v4.0.2 to v4.0.4 (v4.0.5 is outside it)
CVE-2026-42294
Affects v4.0.2 to v4.0.4 (v4.0.5 is outside it)
CVE-2026-42183
Affects v4.0.2 to v4.0.4 (v4.0.5 is outside it)
CVE-2026-42297
Affects v4.0.2 to v4.0.4 (v4.0.5 is outside it)
CVE-2026-40886
Affects v4.0.2 to v4.0.4 (v4.0.5 is outside it)
CVE-2026-31892
No published release is affected
No published release is affected
CVE-2026-28229
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-54526High 8.9
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Affected: from 4.0.0, fixed in 4.0.6.
Fixed in v4.0.6 (released Jun 10, 2026, 36 days before disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-42296High 8.1
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing…
Affected: from 4.0.0, fixed in 4.0.5.
Fixed in v4.0.5 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-42295High 8.5
Argo Workflows: Exposure of artifact repository credentials
Affected: from 4.0.0, fixed in 4.0.5.
Fixed in v4.0.5 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-42294High 8.2
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Affected: from 4.0.0, fixed in 4.0.5.
Fixed in v4.0.5 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-42183Low 2.3
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Affected: from 4.0.0, fixed in 4.0.5.
Fixed in v4.0.5 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-42297High 8.5
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Affected: from 4.0.0, fixed in 4.0.5.
Fixed in v4.0.5 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-40886High 7.7
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
Affected: from 4.0.0, fixed in 4.0.5.
Fixed in v4.0.5 (released Apr 23, 2026, the day of disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-31892High 8.9
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Affected: fixed in 4.0.2.
Fixed in v4.0.2 (released Mar 11, 2026, the day of disclosure).
The latest release, v4.1.6, is not affected.
CVE-2026-28229Critical 9.8
Argo Workflows has unauthorized access to Argo Workflows Template
Affected: fixed in 4.0.2.
Fixed in v4.0.2 (released Mar 11, 2026, the day of disclosure).
The latest release, v4.1.6, is not affected.