PT-2025-50230 · Unknown · Kubernetes+1

Cristianstaicu + 1 · CVE-2025-66626 · Published 2025-10-14 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 3.6.13 and below Argo Workflows versions 3.7.0 through 3.7.4

Description Argo Workflows, a container-native workflow engine for Kubernetes, has an issue with unsafe untar code that improperly handles symbolic links within archives. A flaw exists in how a link's target is calculated and checked. This allows an attacker to overwrite the file /var/run/argo/argoexec with a malicious script, which would then be executed when the pod starts. The previously deployed patch is ineffective against archives containing malicious symbolic links.

Recommendations Update to Argo Workflows version 3.6.14 or later. Update to Argo Workflows version 3.7.5 or later.

Exploit

Fix

RCE

Path traversal

OS Command Injection

Relative Path Traversal

Link Following

Weakness Enumeration

CWE-22

CWE-78

CWE-23

CWE-59

Related Identifiers

BIT-ARGO-WORKFLOWS-2025-66626

CVE-2025-66626

GHSA-P84V-GXVW-73PF

GHSA-XRQC-7XGX-C9VH

GO-2025-4223

OPENSUSE-SU-2026:21483-1

SUSE-SU-2026:0037-1

Affected Products

Argo Workflows

Kubernetes

References · 1757

• 🔥 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66626.json · Exploit
• 🔥 https://github.com/advisories/GHSA-p84v-gxvw-73pf · Exploit
• https://github.com/argoproj/argo-workflows/commit/6b92af23f35aed4d4de8b04adcaf19d68f006de1 · Patch
• https://osv.dev/vulnerability/GHSA-xrqc-7xgx-c9vh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62156 · Security Note
• https://osv.dev/vulnerability/GO-2025-4223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66626 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66626 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p84v-gxvw-73pf · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2025-66626 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/argoproj/argo-workflows · Note
• https://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037 · Note