PT-2026-37193 · Unknown · Argo Workflows

Masamuneee · Published 2026-05-04 · Updated 2026-05-12 · CVE-2026-42295

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.0.0 through 4.0.4

Description The workflow executor logs artifact repository credentials in plaintext during artifact operations. This occurs because the logging driver passes the entire ArtifactDriver struct to the structured logger, exposing sensitive fields such as AccessKey, SecretKey, SessionToken, and ServerSideCustomerKey for S3, AccessKey, SecretKey, and SecurityToken for OSS, and ServiceAccountKey for GCS. Any user with Kubernetes RBAC permissions to read workflow pod logs can extract these credentials.

Recommendations Update to version 4.0.5.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BIT-ARGO-WORKFLOWS-2026-42295

CVE-2026-42295

GHSA-7VF8-2CR6-54MF

Affected Products

Argo Workflows

References · 13

• 🔥 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42295 · Security Note
• https://osv.dev/vulnerability/BIT-argo-workflows-2026-42295 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7vf8-2cr6-54mf · Vendor Advisory
• https://github.com/argoproj/argo-workflows · Note
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-c2hv-4pfj-mm2r · Note
• https://github.com/argoproj/argo-workflows/commit/bdd40908580f727c590c8743836e338b04fe4a87 · Note
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 · Note
• https://github.com/argoproj/argo-workflows/blob/59f1089b9875723ddffd524513e6bd5cb37e5e31/workflow/artifacts/logging/driver.go#L24 · Note
• https://twitter.com/CVEnew/status/2053131389114138705 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053034587270299775 · Twitter Post
• https://t.me/CVEtracker/53206 · Telegram Post
• https://twitter.com/CVEarity/status/2053785739847164004 · Twitter Post