CVE-2026-28229
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Argo Workflows prior to versions 4.0.2 and 3.7.11 contains a vulnerability that allows unauthorized clients to retrieve WorkflowTemplates and ClusterWorkflowTemplates by sending a request with any token in the Authorization header. This can lead to disclosure of sensitive data, including embedded Secret manifests.
Risk Assessment
The risk involves leakage of sensitive information such as passwords, API keys, or certificates that may be stored in workflow templates. An unauthenticated attacker could access this data and use it for further attacks on the Kubernetes infrastructure.
Recommendation
Immediately upgrade Argo Workflows to version 4.0.2 or 3.7.11, which contain the fix for this vulnerability. After the update, review and rotate all secrets that may have been exposed.
Original NVD description (English source)
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.