What are the most common weakness types in argoproj github.com/argoproj/argo-workflows/v2 CVEs?

argoproj github.com/argoproj/argo-workflows/v2's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-522 (Insufficiently Protected Credentials), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-23 (Relative Path Traversal).

What is the average severity of argoproj github.com/argoproj/argo-workflows/v2 CVEs?

The average CVSS base score across argoproj github.com/argoproj/argo-workflows/v2's scored CVEs is 7.6.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Argoproj
Github Com Argoproj Argo Workflows V2

RadicalNotion.AI

We do not sell or share your personal information.

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Argoproj
Github Com Argoproj Argo Workflows V2

argoproj github.com/argoproj/argo-workflows/v2 Vulnerabilities: CVEs, CISA KEV & Security Advisories

argoproj

15 CVEs

golang

argoproj github.com/argoproj/argo-workflows/v2 Vulnerabilities

Name: argoproj github.com/argoproj/argo-workflows/v2 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for github.com/argoproj/argo-workflows/v2 by argoproj.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

7.6

Avg CVSS

2021–2026

Last updated May 9, 2026

Overview

argoproj github.com/argoproj/argo-workflows/v2 has 15 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 14 have a known public exploit. The average CVSS base score across scored CVEs is 7.6.

Severity and exploitation

How the CVSS severity of argoproj github.com/argoproj/argo-workflows/v2's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High10

Medium3

Low1

In CISA’s Known Exploited Vulnerabilities catalog

None of argoproj github.com/argoproj/argo-workflows/v2's CVEs are currently listed in CISA's KEV catalog.

Public exploits

14 of argoproj github.com/argoproj/argo-workflows/v2's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every argoproj github.com/argoproj/argo-workflows/v2 version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

>= 2.9.01 CVE

Find a version

15 CVEs

Sort

Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
CVE-2026-42296
Public exploit
Patch
Workaround
CWE-863
High · CVSS 8.1
EPSS 0.5% (41th pct)2026-05-09
Argo Workflows: Exposure of artifact repository credentials
CVE-2026-42295
Public exploit
Patch
CWE-522
High · CVSS 8.5
EPSS 0.4% (33th pct)2026-05-09
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
CVE-2026-42294
Public exploit
Patch
Workaround
CWE-770
High · CVSS 8.2
EPSS 0.7% (54th pct)2026-05-09
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
CVE-2026-42183
Public exploit
Patch
CWE-476
Low · CVSS 2.3
EPSS 0.6% (46th pct)2026-05-09
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
CVE-2026-42297
Public exploit
Patch
CWE-862
High · CVSS 8.5
EPSS 0.5% (43th pct)2026-05-09
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
CVE-2026-40886
Public exploit
Patch
CWE-129
High · CVSS 7.0
EPSS 0.6% (47th pct)2026-04-23
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
CVE-2026-31892
Public exploit
Patch
CWE-863
High · CVSS 8.9
EPSS 0.7% (51th pct)2026-03-11
Argo Workflows has unauthorized access to Argo Workflows Template
CVE-2026-28229
Public exploit
Patch
CWE-863
Critical · CVSS 9.8
EPSS 0.8% (56th pct)2026-03-11
Argo Workflows affected by stored XSS in the artifact directory listing
CVE-2026-23960
Public exploit
Patch
CWE-79
High · CVSS 7.3
EPSS 0.4% (33th pct)2026-01-21
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
CVE-2025-66626
Public exploit
Patch
CWE-23
High · CVSS 8.1
EPSS 0.7% (51th pct)2025-12-09
Argo Workflows exposes artifact repository credentials in workflow-controller logs
CVE-2025-62157
Patch
CWE-522
High · CVSS 8.5
EPSS 0.5% (39th pct)2025-10-14
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
CVE-2025-62156
Public exploit
Patch
CWE-22
High · CVSS 8.8
EPSS 0.6% (47th pct)2025-10-14
Access to Archived Argo Workflows with Fake Token in `client` mode
CVE-2024-53862
Public exploit
Patch
CWE-290
Medium · CVSS 6.3
EPSS 0.7% (51th pct)2024-12-02
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
CVE-2024-47827
Public exploit
Patch
CWE-362
Medium · CVSS 6.9
EPSS 0.4% (28th pct)2024-10-28
Workflow re-write vulnerability using input parameter
CVE-2021-37914
Public exploit
Patch
CWE-20
Medium · CVSS 6.5
EPSS 1.0% (61th pct)2021-08-02

Common weakness types

The CWE weakness categories most often found in argoproj github.com/argoproj/argo-workflows/v2 CVEs. Follow any weakness for its full explanation.

CWE-863Incorrect Authorization3 CVEs
CWE-522Insufficiently Protected Credentials2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVE
CWE-23Relative Path Traversal1 CVE
CWE-290Authentication Bypass by Spoofing1 CVE

Disclosure activity by year

How many argoproj github.com/argoproj/argo-workflows/v2 CVEs were published each year.

2021

2024

2025

2026

Other argoproj products

Browse vulnerabilities for other products by argoproj.

argo-cd61 CVEs argo cd58 CVEs github.com/argoproj/argo-cd/v251 CVEs github.com/argoproj/argo-cd49 CVEs argo workflows18 CVEs argo-workflows18 CVEs github.com/argoproj/argo-workflows/v317 CVEs

Frequently asked questions

Common questions about argoproj github.com/argoproj/argo-workflows/v2 vulnerabilities.

How many CVEs does argoproj github.com/argoproj/argo-workflows/v2 have?: argoproj github.com/argoproj/argo-workflows/v2 has 15 published CVE records since 2021.
How many argoproj github.com/argoproj/argo-workflows/v2 CVEs are in CISA KEV?: None of argoproj github.com/argoproj/argo-workflows/v2's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for argoproj github.com/argoproj/argo-workflows/v2 vulnerabilities?: Yes — 14 of argoproj github.com/argoproj/argo-workflows/v2's CVEs have a known public exploit.
Which versions of argoproj github.com/argoproj/argo-workflows/v2 are affected?: 1 distinct argoproj github.com/argoproj/argo-workflows/v2 version is named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in argoproj github.com/argoproj/argo-workflows/v2 CVEs?: argoproj github.com/argoproj/argo-workflows/v2's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-522 (Insufficiently Protected Credentials), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-23 (Relative Path Traversal).
How many critical argoproj github.com/argoproj/argo-workflows/v2 vulnerabilities are there?: argoproj github.com/argoproj/argo-workflows/v2 has 1 critical and 10 high-severity CVEs.
What is the average severity of argoproj github.com/argoproj/argo-workflows/v2 CVEs?: The average CVSS base score across argoproj github.com/argoproj/argo-workflows/v2's scored CVEs is 7.6.