CVE-2026-28229: Argo Workflows authentication bypass in workflow template endpoints

CVE-2026-28229 · Severity: critical · CVSS 9.8 · Published 2026-03-11

Argo Workflows, a tool used to manage complex automated tasks on Kubernetes, contains a security flaw that allows unauthorized users to view sensitive workflow templates. By sending a specially crafted request, an attacker can access internal configuration details, including passwords and secret credentials stored within these templates. This could lead to a full compromise of the automated tasks and the sensitive data they handle.

Technologies: Argo Project Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go), github.com/argoproj/argo-workflows/v3 (Go), github.com/argoproj/argo-workflows/v4 (Go). Vendors: Argo Project, Go.

Quick answers

Is CVE-2026-28229 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28229 being exploited in the wild.
How severe is CVE-2026-28229?
Critical severity, with a CVSS score of 9.8, published 11 March 2026.
Which products and versions are affected?
Argo Project Workflows >= 3.7.0, < 3.7.11, >= 3.7.0, < 3.7.11; >= 4.0.0, < 4.0.2; github.com/argoproj/argo-workflows (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v3 (Go) >= 3.7.0, < 3.7.11, SEMVER:introduced=0,fixed=3.7.11, SEMVER:introduced=3.7.0,fixed=3.7.11; and 1 more.
Is there a fix for CVE-2026-28229?
Yes. github.com/argoproj/argo-workflows/v3 (Go): upgrade to 3.7.11 or later; github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28229 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28229?
Check whether you run Argo Project Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/argoproj/argo-workflows/v3 (Go): upgrade to 3.7.11 or later
    go get github.com/argoproj/argo-workflows/v3@v3.7.11
  • github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.2 or later
    go get github.com/argoproj/argo-workflows/v4@v4.0.2

Technical details

A vulnerability in the Argo Workflows server allows unauthenticated clients to bypass authorization checks when accessing WorkflowTemplates and ClusterWorkflowTemplates endpoints. The issue stems from the server's failure to properly validate bearer tokens; specifically, providing a 'Bearer nothing' token allows the request to proceed using the server's service account privileges. An attacker can exploit this to leak sensitive template data, including embedded Secret manifests, environment variables, and service account usage. The vulnerability is fixed in versions 3.7.11 and 4.0.2.

Affected products

  • argoproj Argo Workflows >= 3.7.0, < 3.7.11; >= 4.0.0, < 4.0.2
  • Red Hat Red Hat OpenShift AI 2.25 affected

Identifiers

  • CVE-2026-28229
  • GHSA-56px-hm34-xqj5
  • GO-2026-4678

Timeline

  • 2026-03-11: disclosed
  • 2026-03-11: advisory
  • 2026-03-11: patched
  • 2026-04-23: other: Red Hat security advisory issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.