Executive brief
Argo Workflows is an automation engine used to manage complex computing tasks on Kubernetes. A security flaw in certain versions causes the system to record sensitive credentials—such as S3 access keys, Azure account keys, and Git passwords—in plain text within system logs. Any user with permission to view these logs can steal these credentials, potentially gaining unauthorized access to the organization's cloud storage and external data repositories.
Technical details
In Argo Workflows versions 4.0.0 through 4.0.4, the workflow executor's logging driver incorrectly passes the entire 'ArtifactDriver' struct to a structured logger. This results in sensitive fields—including S3 AccessKeys/SecretKeys, GCS ServiceAccountKeys, and Git passwords—being written to the pod logs in plaintext during artifact loading or saving operations. An attacker with Kubernetes RBAC permissions to read pod logs (specifically the 'wait' container) in the workflow namespace can extract these credentials. This vulnerability is an incomplete fix of a previous issue (CVE-2025-62157) and has been patched in version 4.0.5.
Affected products
- Argo Project Argo Workflows >=4.0.0, < 4.0.5
Timeline
- 2026-04-23: patched: Version 4.0.5 released to address the leak.
- 2026-04-23: advisory: GitHub Security Advisory GHSA-7vf8-2cr6-54mf published.
- 2026-05-09: disclosed: CVE-2026-42295 published to the NVD.