CVE-2026-23960: Argo Workflows stored XSS in artifact directory listing

CVE-2026-23960 · Severity: medium · CVSS 5.4 · Published 2026-01-21

Argo Workflows, a tool used to manage complex computing tasks on Kubernetes, contains a security flaw in how it displays file directories. An attacker with the ability to create workflows can inject malicious scripts that run in the browsers of other users, such as administrators. This could allow the attacker to perform unauthorized actions or access sensitive data using the victim's account permissions.

Technologies: Argo Project Argo Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go), github.com/argoproj/argo-workflows/v3 (Go). Vendors: Argo Project, Go.

Quick answers

Is CVE-2026-23960 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23960 being exploited in the wild.
How severe is CVE-2026-23960?
Medium severity, with a CVSS score of 5.4, published 21 January 2026.
Which products and versions are affected?
Argo Project Argo Workflows < 3.6.17, >= 3.7.0, < 3.7.8; github.com/argoproj/argo-workflows (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.5.3-rc4; github.com/argoproj/argo-workflows/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v3 (Go) SEMVER:introduced=0,fixed=3.6.17, SEMVER:introduced=0,fixed=3.6.17,introduced=3.7.0,fixed=3.7.8.
Is there a fix for CVE-2026-23960?
Yes. github.com/argoproj/argo-workflows/v3 (Go): upgrade to 3.6.17, 3.7.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23960 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-23960?
Check whether you run Argo Project Argo Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/argoproj/argo-workflows/v3 (Go): upgrade to 3.6.17, 3.7.8 or later
    go get github.com/argoproj/argo-workflows/v3@v3.7.8

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Argo Workflows artifact directory listing. The root cause is improper neutralization of input during the generation of the web page for artifact listings in 'artifact_server.go'. An attacker with workflow creation privileges (PR:L) can craft malicious artifact names or paths that, when viewed by another user (UI:R), execute arbitrary JavaScript under the Argo Server origin. This can be leveraged to perform API requests with the victim's authorization. The issue is resolved in versions 3.6.17 and 3.7.8 by implementing proper HTML templating and escaping.

Affected products

  • argoproj Argo Workflows < 3.6.17, >= 3.7.0, < 3.7.8
  • Red Hat Red Hat OpenShift AI (RHOAI)

Identifiers

  • CVE-2026-23960
  • GHSA-cv78-6m8q-ph82
  • GO-2026-4350

Timeline

  • 2026-01-21: disclosed
  • 2026-01-21: patched: Versions 3.6.17 and 3.7.8 released
  • 2026-01-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.