AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

argo-workflowsGHSA-rc7p-gmvh-xfx2

Attack on Kubernetes via Misconfigured Argo Workflows

argo-workflows

Published Aug 2, 2021

Medium
No fix yet
GitHub advisory

Impact

Users running using the Argo Server with --auth-mode=server (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.

Resolution

  • Do not expose your user interface to the Internet.
  • Change configuration. --auth-mode=client.

For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.

Affected versions

PackageAffectedFixed in
github.com/argoproj/argo-workflows
Go
all versionsNo fix yet
Details and references
Severity from
GitHub (reviewed advisory)

More argo-workflows advisories

All argo-workflows
Medium 6.5Nov 5, 2025Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflowsCVE-2025-62157no fix yetHigh 7.5Dec 2, 2024Argo Workflows Allows Access to Archived Workflows with Fake Token in `client`...CVE-2024-53862no fix yetMedium 5.7Oct 30, 2024argo-workflows: denial of serviceCVE-2024-47827no fix yetMedium 6.5Aug 21, 2024Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflowsCVE-2021-37914no fix yetUnscoredAug 21, 2024argo-workflows: privilege escalationGO-2022-0405no fix yetUnscoredAug 21, 2024Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflowsGO-2022-0388no fix yet