How many CVEs have a located fix in argoproj/argo-workflows?

16 published CVEs have a fix traced to functions in argoproj/argo-workflows, touching 68 functions across 37 files.

Which function in argoproj/argo-workflows has been patched by the most CVEs?

returnArtifact in server/artifacts/artifact_server.go has been changed by 2 CVE fixes, from 2022 to 2026.

How large is a typical CVE fix in argoproj/argo-workflows?

The median fix changes 32 lines. 31% of fixes change 20 lines or fewer, and 38% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

#350 of 500 repositories

argoproj/argo-workflows

Name: argoproj/argo-workflows: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 19, 2026

16

CVE fixes located

Published CVEs

68

Functions patched

Distinct function sites

37

Files patched

Distinct source files

2021–2026

Years covered

By CVE publication date

Overview

16 published CVEs have a fix traced to functions in argoproj/argo-workflows, the earliest published in 2021. Those fixes changed 68 distinct functions across 37 files, in 148 patch hunks.

Among the 500 repositories tracked here, argoproj/argo-workflows ranks #350 by the number of CVEs with a located fix.

Most patched functions

Functions in argoproj/argo-workflows changed by the most CVE fixes.

Most patched files

Files in argoproj/argo-workflows changed by the most CVE fixes.

1workflow/controller/operator.go2 CVEs · 6 functions
2server/artifacts/artifact_server.go2 CVEs · 4 functions
3server/apiserver/argoserver.go2 CVEs · 3 functions
4workflow/util/merge.go2 CVEs · 2 functions
5server/workflowarchive/archived_workflow_server.go2 CVEs · 1 functions
6workflow/executor/executor.go2 CVEs · 1 functions
7server/sync/sync_cm.go1 CVEs · 5 functions
8workflow/artifacts/logging/driver.go1 CVEs · 5 functions
9persist/sqldb/workflow_archive.go1 CVEs · 4 functions
10server/workflow/workflow_server.go1 CVEs · 4 functions

Fix size

How much code a CVE fix in argoproj/argo-workflows changes, with backports counted once.

32

Median lines changed

Added plus removed, per CVE

31%

Fixes of 20 lines or fewer

Share of CVE fixes

38%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in argoproj/argo-workflows, and the functions each fix changed.

Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
CVE-2026-93991ListArchivedWorkflows
High · CVSS 8.3
EPSS 0.4%2026-09-19
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
CVE-2026-54526artifactGCOverrideViolations ValidateUserOverrides
High · CVSS 8.9
EPSS 0.6%2026-07-16
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
CVE-2026-42296setExecWorkflow setStoredWfSpec
High · CVSS 8.1
EPSS 0.5%2026-05-09
Argo Workflows: Exposure of artifact repository credentials
CVE-2026-42295Delete IsDirectory Load
High · CVSS 8.5
EPSS 0.4%2026-05-09
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
CVE-2026-42294addWebhookAuthorization
High · CVSS 8.2
EPSS 0.7%2026-05-09
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
CVE-2026-42183rbacAuthorization
Low · CVSS 2.3
EPSS 0.6%2026-05-09
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
CVE-2026-42297checkConfigMapPermission updateSyncLimit createSyncLimit
High · CVSS 8.5
EPSS 0.5%2026-05-09
Argo Workflows has unauthorized access to Argo Workflows Template
CVE-2026-28229GetClusterWorkflowTemplate GetWorkflowTemplate
Critical · CVSS 9.8
EPSS 0.8%2026-03-11
Argo Workflows affected by stored XSS in the artifact directory listing
CVE-2026-23960renderDirectoryListing GetArtifactFile setSecurityHeaders
High · CVSS 7.3
EPSS 0.4%2026-01-21
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
CVE-2025-66626untar
High · CVSS 8.1
EPSS 0.7%2025-12-09
Argo Workflows exposes artifact repository credentials in workflow-controller logs
CVE-2025-62157updateConfig
High · CVSS 8.5
EPSS 0.5%2025-10-14
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
CVE-2025-62156untar
High · CVSS 8.8
EPSS 0.6%2025-10-14

Get an alert for each new argoproj/argo-workflows CVE, with the patched functions and AI-written analysis.

Monitor argo-workflows CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Alinto/sogo16 CVEs android.googlesource.com/platform-system-bt16 CVEs codeigniter4/CodeIgniter416 CVEs debian/libmatio16 CVEs debian/libvncserver16 CVEs debian/netatalk16 CVEs debian/nss16 CVEs debian/poppler16 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in argoproj/argo-workflows.

How many CVEs have a located fix in argoproj/argo-workflows?: 16 published CVEs have a fix traced to functions in argoproj/argo-workflows, touching 68 functions across 37 files.
Which function in argoproj/argo-workflows has been patched by the most CVEs?: returnArtifact in server/artifacts/artifact_server.go has been changed by 2 CVE fixes, from 2022 to 2026.
How large is a typical CVE fix in argoproj/argo-workflows?: The median fix changes 32 lines. 31% of fixes change 20 lines or fewer, and 38% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track argoproj/argo-workflows CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing