argoproj argo-workflows vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20242
3. 20253
4. 202611

Newest CVEs

• CVE-2026-93991

  Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

  argoproj · argo-workflows

  High8.3
• CVE-2026-54526

  Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

  argoproj · argo-workflows

  High8.9
• CVE-2026-42296

  Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

  argoproj · argo-workflows

  High8.1
• CVE-2026-42295

  Argo Workflows: Exposure of artifact repository credentials

  argoproj · argo-workflows

  High8.5
• CVE-2026-42294

  Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

  argoproj · argo-workflows

  High8.2
• CVE-2026-42183

  Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

  argoproj · argo-workflows

  Low2.3
• CVE-2026-42297

  Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

  argoproj · argo-workflows

  High8.5
• CVE-2026-40886

  Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

  argoproj · argo-workflows

  High7.7
• CVE-2026-31892

  WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

  argoproj · argo-workflows

  High8.9
• CVE-2026-28229

  Argo Workflows has unauthorized access to Argo Workflows Template

  argoproj · argo-workflows

  Critical9.8