Skip to content
Advisories.
argo-workflowsGO-2022-0388

Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows

UnratedPublished Aug 21, 2024 · updated Mar 3, 2026

Source advisory

Affected versions

PackageAffectedFixed in
github.com/argoproj/argo-workflows
Go
all versionsNo fix yet
Details and references

Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows

Severity from
no source yet
Also known as
GHSA-6c73-2v8x-qpvm

More argo-workflows advisories

All
DateAdvisory
Aug 212024Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows
GO-2022-0405Unratedno fix yet
Aug 212024Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows
CVE-2021-37914Unratedno fix yet
Oct 302024Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows
CVE-2024-47827Unratedno fix yet
Dec 22024Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows
CVE-2024-53862Unratedno fix yet
Nov 52025Argo Workflow has a Zipslip Vulnerability in github.com/argoproj/argo-workflows
CVE-2025-62156Unratedno fix yet
Nov 52025Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows
CVE-2025-62157Unratedno fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.