PT-2026-24700 · Unknown · Argo Workflows

Masamuneee · Published 2026-03-11 · Updated 2026-05-13 · CVE-2026-28229

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 4.0.2 and 3.7.11

Description Argo Workflows, an open source container-native workflow engine for Kubernetes, has an issue where Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. A request with an Authorization: Bearer nothing token can expose sensitive template content, including embedded Secret manifests. The issue stems from how informers use the server’s rest config, reading using server service account privileges. A proof-of-concept demonstrates the ability to leak template data, including secrets, artifact locations, service account usage, environment variables, and resource manifests.

Recommendations Update to Argo Workflows version 4.0.2 or 3.7.11.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

BIT-ARGO-WORKFLOWS-2026-28229

CVE-2026-28229

GHSA-56PX-HM34-XQJ5

GO-2026-4678

SUSE-SU-2026:1042-1

Affected Products

Argo Workflows

References · 143

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28229.json · Exploit
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28229 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28229 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-28229 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-workflows-2026-28229 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-56px-hm34-xqj5 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4678 · Vendor Advisory
• https://github.com/argoproj/argo-workflows · Note
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.2 · Note
• https://github.com/argoproj/argo-workflows/releases/tag/v3.7.11 · Note
• https://github.com/argoproj/argo-workflows/commit/34afaf9c0c36f1ba8645d483ea4752cfc4a391e8 · Note
• https://suse.com/security/cve/CVE-2026-27616 · Note
• https://suse.com/security/cve/CVE-2026-28492 · Note