argo-workflowsGO-2024-3303

Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows

UnratedCVE-2024-53862 · Published Dec 2, 2024 · updated Feb 4, 2026

Source advisory

Affected versions

Package	Affected	Fixed in
github.com/argoproj/argo-workflows Go	all versions	No fix yet

Details and references

Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows

Severity from: no source yet
Also known as: BIT-argo-workflows-2024-53862, CVE-2024-53862, GHSA-h36c-m3rf-34h9

More argo-workflows advisories

Date	Advisory	Severity	Fixed in
Oct 302024	Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows CVE-2024-47827Unratedno fix yet	Unrated	No fix yet
Aug 212024	Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows CVE-2021-37914Unratedno fix yet	Unrated	No fix yet
Aug 212024	Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows GO-2022-0388Unratedno fix yet	Unrated	No fix yet
Aug 212024	Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows GO-2022-0405Unratedno fix yet	Unrated	No fix yet
Nov 52025	Argo Workflow has a Zipslip Vulnerability in github.com/argoproj/argo-workflows CVE-2025-62156Unratedno fix yet	Unrated	No fix yet
Nov 52025	Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows CVE-2025-62157Unratedno fix yet	Unrated	No fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.