Which versions of argoproj github.com/argoproj/argo-workflows are affected?

2 distinct argoproj github.com/argoproj/argo-workflows versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in argoproj github.com/argoproj/argo-workflows CVEs?

argoproj github.com/argoproj/argo-workflows's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-522 (Insufficiently Protected Credentials), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-23 (Relative Path Traversal).

What is the average severity of argoproj github.com/argoproj/argo-workflows CVEs?

The average CVSS base score across argoproj github.com/argoproj/argo-workflows's scored CVEs is 7.7.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Argoproj
Github Com Argoproj Argo Workflows

RadicalNotion.AI

We do not sell or share your personal information.

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Argoproj
Github Com Argoproj Argo Workflows

argoproj github.com/argoproj/argo-workflows Vulnerabilities: CVEs, CISA KEV & Security Advisories

argoproj

16 CVEs

golang

argoproj github.com/argoproj/argo-workflows Vulnerabilities

Name: argoproj github.com/argoproj/argo-workflows vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for github.com/argoproj/argo-workflows by argoproj.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

7.7

Avg CVSS

2021–2026

Last updated July 16, 2026

Overview

argoproj github.com/argoproj/argo-workflows has 16 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 15 have a known public exploit. The average CVSS base score across scored CVEs is 7.7.

Severity and exploitation

How the CVSS severity of argoproj github.com/argoproj/argo-workflows's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High11

Medium3

Low1

In CISA’s Known Exploited Vulnerabilities catalog

None of argoproj github.com/argoproj/argo-workflows's CVEs are currently listed in CISA's KEV catalog.

Public exploits

15 of argoproj github.com/argoproj/argo-workflows's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every argoproj github.com/argoproj/argo-workflows version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

<= 2.5.3-rc43 CVEs
2.9.0 <= v < 3.0.01 CVE

Find a version

16 CVEs

Sort

Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
CVE-2026-54526
Public exploit
Patch
CWE-284
High · CVSS 8.9
EPSS 0.6% (45th pct)2026-07-16
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
CVE-2026-42296
Public exploit
Patch
Workaround
CWE-863
High · CVSS 8.1
EPSS 0.5% (41th pct)2026-05-09
Argo Workflows: Exposure of artifact repository credentials
CVE-2026-42295
Public exploit
Patch
CWE-522
High · CVSS 8.5
EPSS 0.4% (33th pct)2026-05-09
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
CVE-2026-42294
Public exploit
Patch
Workaround
CWE-770
High · CVSS 8.2
EPSS 0.7% (54th pct)2026-05-09
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
CVE-2026-42183
Public exploit
Patch
CWE-476
Low · CVSS 2.3
EPSS 0.6% (46th pct)2026-05-09
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
CVE-2026-42297
Public exploit
Patch
CWE-862
High · CVSS 8.5
EPSS 0.5% (43th pct)2026-05-09
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
CVE-2026-40886
Public exploit
Patch
CWE-129
High · CVSS 7.0
EPSS 0.6% (47th pct)2026-04-23
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
CVE-2026-31892
Public exploit
Patch
CWE-863
High · CVSS 8.9
EPSS 0.7% (51th pct)2026-03-11
Argo Workflows has unauthorized access to Argo Workflows Template
CVE-2026-28229
Public exploit
Patch
CWE-863
Critical · CVSS 9.8
EPSS 0.8% (56th pct)2026-03-11
Argo Workflows affected by stored XSS in the artifact directory listing
CVE-2026-23960
Public exploit
Patch
CWE-79
High · CVSS 7.3
EPSS 0.4% (33th pct)2026-01-21
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
CVE-2025-66626
Public exploit
Patch
CWE-23
High · CVSS 8.1
EPSS 0.7% (51th pct)2025-12-09
Argo Workflows exposes artifact repository credentials in workflow-controller logs
CVE-2025-62157
Patch
CWE-522
High · CVSS 8.5
EPSS 0.5% (39th pct)2025-10-14
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
CVE-2025-62156
Public exploit
Patch
CWE-22
High · CVSS 8.8
EPSS 0.6% (47th pct)2025-10-14
Access to Archived Argo Workflows with Fake Token in `client` mode
CVE-2024-53862
Public exploit
Patch
CWE-290
Medium · CVSS 6.3
EPSS 0.7% (51th pct)2024-12-02
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
CVE-2024-47827
Public exploit
Patch
CWE-362
Medium · CVSS 6.9
EPSS 0.4% (28th pct)2024-10-28
Workflow re-write vulnerability using input parameter
CVE-2021-37914
Public exploit
Patch
CWE-20
Medium · CVSS 6.5
EPSS 1.0% (61th pct)2021-08-02

Common weakness types

The CWE weakness categories most often found in argoproj github.com/argoproj/argo-workflows CVEs. Follow any weakness for its full explanation.

CWE-863Incorrect Authorization3 CVEs
CWE-522Insufficiently Protected Credentials2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVE
CWE-23Relative Path Traversal1 CVE
CWE-284Improper Access Control1 CVE

Disclosure activity by year

How many argoproj github.com/argoproj/argo-workflows CVEs were published each year.

2021

2024

2025

2026

Other argoproj products

Browse vulnerabilities for other products by argoproj.

argo-cd61 CVEs argo cd58 CVEs github.com/argoproj/argo-cd/v251 CVEs github.com/argoproj/argo-cd49 CVEs argo workflows18 CVEs argo-workflows18 CVEs github.com/argoproj/argo-workflows/v317 CVEs

Frequently asked questions

Common questions about argoproj github.com/argoproj/argo-workflows vulnerabilities.

How many CVEs does argoproj github.com/argoproj/argo-workflows have?: argoproj github.com/argoproj/argo-workflows has 16 published CVE records since 2021.
How many argoproj github.com/argoproj/argo-workflows CVEs are in CISA KEV?: None of argoproj github.com/argoproj/argo-workflows's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for argoproj github.com/argoproj/argo-workflows vulnerabilities?: Yes — 15 of argoproj github.com/argoproj/argo-workflows's CVEs have a known public exploit.
Which versions of argoproj github.com/argoproj/argo-workflows are affected?: 2 distinct argoproj github.com/argoproj/argo-workflows versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in argoproj github.com/argoproj/argo-workflows CVEs?: argoproj github.com/argoproj/argo-workflows's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-522 (Insufficiently Protected Credentials), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-23 (Relative Path Traversal).
How many critical argoproj github.com/argoproj/argo-workflows vulnerabilities are there?: argoproj github.com/argoproj/argo-workflows has 1 critical and 11 high-severity CVEs.
What is the average severity of argoproj github.com/argoproj/argo-workflows CVEs?: The average CVSS base score across argoproj github.com/argoproj/argo-workflows's scored CVEs is 7.7.