argo-workflowsGO-2026-4678
Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows
UnratedCVE-2026-28229 · Published Mar 12, 2026 · updated Mar 23, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/argoproj/argo-workflows Go | all versions | No fix yet |
Details and references
Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows
- Severity from
- no source yet
- Also known as
- BIT-argo-workflows-2026-28229, CVE-2026-28229, GHSA-56px-hm34-xqj5
- github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5
- nvd.nist.gov/vuln/detail/CVE-2026-28229
- github.com/argoproj/argo-workflows/commit/34afaf9c0c36f1ba8645d483ea4752cfc4a391e8
- github.com/argoproj/argo-workflows/releases/tag/v3.7.11
- github.com/argoproj/argo-workflows/releases/tag/v4.0.2
More argo-workflows advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 11 | Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode CVE-2026-31892Highno fix yet | High | No fix yet |
| Jan 21 | Argo Workflows affected by stored XSS in the artifact directory listing CVE-2026-23960Highno fix yet | High | No fix yet |
| Dec 92025 | RCE via ZipSlip and symbolic links in argoproj/argo-workflows CVE-2025-66626High8.1no fix yet | High8.1 | No fix yet |
| Jun 25 | Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows CVE-2026-42296High8.1no fix yet | High8.1 | No fix yet |
| Jun 25 | Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows CVE-2026-40886Unratedno fix yet | Unrated | No fix yet |
| Jun 25 | Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows CVE-2026-42295Medium4.9no fix yet | Medium4.9 | No fix yet |