Executive brief
Argo Workflows, a tool used to manage complex automated tasks on Kubernetes, contains a security flaw that allows unauthorized users to view sensitive workflow templates. By sending a specially crafted request, an attacker can access internal configuration details, including passwords and secret credentials stored within these templates. This could lead to a full compromise of the automated tasks and the sensitive data they handle.
Technical details
A vulnerability in the Argo Workflows server allows unauthenticated clients to bypass authorization checks when accessing WorkflowTemplates and ClusterWorkflowTemplates endpoints. The issue stems from the server's failure to properly validate bearer tokens; specifically, providing a 'Bearer nothing' token allows the request to proceed using the server's service account privileges. An attacker can exploit this to leak sensitive template data, including embedded Secret manifests, environment variables, and service account usage. The vulnerability is fixed in versions 3.7.11 and 4.0.2.
Affected products
- argoproj Argo Workflows >= 3.7.0, < 3.7.11; >= 4.0.0, < 4.0.2
- Red Hat Red Hat OpenShift AI 2.25 affected
Timeline
- 2026-03-11: disclosed
- 2026-03-11: advisory
- 2026-03-11: patched
- 2026-04-23: other: Red Hat security advisory issued
References
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/security/cve/CVE-2026-28229
- https://bugzilla.redhat.com/show_bug.cgi?id=2446549
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28229.json