argo-workflowsGO-2022-0405
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows
UnratedPublished Aug 21, 2024 · updated Mar 3, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/argoproj/argo-workflows Go | all versions | No fix yet |
Details and references
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows
- Severity from
- no source yet
- Also known as
- GHSA-prqf-xr2j-xf65
More argo-workflows advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 212024 | Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows GO-2022-0388Unratedno fix yet | Unrated | No fix yet |
| Aug 212024 | Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows CVE-2021-37914Unratedno fix yet | Unrated | No fix yet |
| Oct 302024 | Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows CVE-2024-47827Unratedno fix yet | Unrated | No fix yet |
| Dec 22024 | Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows CVE-2024-53862Unratedno fix yet | Unrated | No fix yet |
| Nov 52025 | Argo Workflow has a Zipslip Vulnerability in github.com/argoproj/argo-workflows CVE-2025-62156Unratedno fix yet | Unrated | No fix yet |
| Nov 52025 | Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows CVE-2025-62157Unratedno fix yet | Unrated | No fix yet |