PT-2021-21906 · Unknown · Argo Workflows

Alex Collins + 1 · Published 2021-08-02 · Updated 2026-02-13 · CVE-2021-37914

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Argo Workflows versions 3.1.3 and earlier

Description: The issue arises when EXPRESSION TEMPLATES is enabled and untrusted users can specify input parameters for workflows. This allows an attacker to potentially disrupt a workflow because the output of expression templates is evaluated.

Recommendations: For versions 3.1.3 and earlier, set EXPRESSION TEMPLATES=false for the workflow controller as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-ARGO-WORKFLOWS-2021-37914

CVE-2021-37914

GHSA-H563-XH25-X54Q

GO-2022-0928

Affected Products

Argo Workflows

References · 13

• 🔥 https://github.com/argoproj/argo-workflows/pull/6442 · Exploit
• 🔥 https://github.com/argoproj/argo-workflows/issues/6441 · Exploit
• https://osv.dev/vulnerability/CVE-2021-37914 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37914 · Security Note
• https://osv.dev/vulnerability/BIT-argo-workflows-2021-37914 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h563-xh25-x54q · Vendor Advisory
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-h563-xh25-x54q · Note
• https://github.com/argoproj/argo-workflows/commit/2a2ecc916925642fd8cb1efd026588e6828f82e1 · Note
• https://github.com/argoproj/argo-workflows/pull/6285 · Note
• https://t.me/cveNotify/152002 · Telegram Post
• https://t.me/cvenotify/18517 · Telegram Post
• https://t.me/cibsecurity/26726 · Telegram Post