Argoproj Argo Workflows

WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows has unauthorized access to Argo Workflows Template

argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite

Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Argo Workflows exposes artifact repository credentials in workflow-controller logs

Argo Workflows: Exposure of artifact repository credentials

Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode

Argo Workflows affected by stored XSS in the artifact directory listing

Privilege Escalation in argo-workflows

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.

Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

Argo Workflows Controller: Denial of Service via malicious daemon Workflows