CVE-2026-42295: Argo Workflows plaintext credential leak in workflow logs

CVE-2026-42295 · Severity: high · CVSS 4.9 · Published 2026-05-09

Argo Workflows is an automation engine used to manage complex computing tasks on Kubernetes. A security flaw in certain versions causes the system to record sensitive credentials—such as S3 access keys, Azure account keys, and Git passwords—in plain text within system logs. Any user with permission to view these logs can steal these credentials, potentially gaining unauthorized access to the organization's cloud storage and external data repositories.

Technologies: Argo Project Argo Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go), github.com/argoproj/argo-workflows/v3 (Go), github.com/argoproj/argo-workflows/v4 (Go). Vendors: Argo Project, Go.

Quick answers

Is CVE-2026-42295 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42295 being exploited in the wild.
How severe is CVE-2026-42295?
High severity, with a CVSS score of 4.9, published 9 May 2026.
Which products and versions are affected?
Argo Project Argo Workflows >= 4.0.0, < 4.0.5, >=4.0.0, < 4.0.5; github.com/argoproj/argo-workflows (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v3 (Go) SEMVER:introduced=0; and 1 more.
Is there a fix for CVE-2026-42295?
Yes. github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42295 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42295?
Check whether you run Argo Project Argo Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later
    go get github.com/argoproj/argo-workflows/v4@v4.0.5

Technical details

In Argo Workflows versions 4.0.0 through 4.0.4, the workflow executor's logging driver incorrectly passes the entire 'ArtifactDriver' struct to a structured logger. This results in sensitive fields—including S3 AccessKeys/SecretKeys, GCS ServiceAccountKeys, and Git passwords—being written to the pod logs in plaintext during artifact loading or saving operations. An attacker with Kubernetes RBAC permissions to read pod logs (specifically the 'wait' container) in the workflow namespace can extract these credentials. This vulnerability is an incomplete fix of a previous issue (CVE-2025-62157) and has been patched in version 4.0.5.

Affected products

  • Argo Project Argo Workflows >=4.0.0, < 4.0.5

Identifiers

  • CVE-2026-42295
  • GHSA-7vf8-2cr6-54mf
  • GO-2026-5235

Timeline

  • 2026-04-23: patched: Version 4.0.5 released to address the leak.
  • 2026-04-23: advisory: GitHub Security Advisory GHSA-7vf8-2cr6-54mf published.
  • 2026-05-09: disclosed: CVE-2026-42295 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.