argo-workflowsGO-2026-5235

Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows

Medium4.9CVE-2026-42295 · Published Jun 25, 2026 · updated Jul 2, 2026

Source advisory

Affected versions

Package	Affected	Fixed in
github.com/argoproj/argo-workflows Go	all versions	No fix yet

Changes since it was listed

Date	Change
Sep 25	Severity: Unrated to Medium

Details and references

Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Severity from: NVD
Also known as: BIT-argo-workflows-2026-42295, CVE-2026-42295, GHSA-7vf8-2cr6-54mf

More argo-workflows advisories

Date	Advisory	Severity	Fixed in
Jun 25	Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows CVE-2026-42296High8.1no fix yet	High8.1	No fix yet
Jun 25	Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows CVE-2026-40886Unratedno fix yet	Unrated	No fix yet
Jun 25	Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows CVE-2026-42294High7.5no fix yet	High7.5	No fix yet
Jun 25	Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows CVE-2026-42183Medium6.5no fix yet	Medium6.5	No fix yet
Jun 25	Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows CVE-2026-42297High8.3no fix yet	High8.3	No fix yet
Aug 13	Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) CVE-2026-54526Highno fix yet	High	No fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.