PT-2026-37193 · Unknown · Argo Workflows

Masamuneee · CVE-2026-42295 · Published 2026-05-04 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.0.0 through 4.0.4

Description The workflow executor logs artifact repository credentials in plaintext during artifact operations. This occurs because the logging driver passes the entire ArtifactDriver struct to the structured logger, exposing sensitive fields such as AccessKey, SecretKey, SessionToken, and ServerSideCustomerKey for S3, AccessKey, SecretKey, and SecurityToken for OSS, and ServiceAccountKey for GCS. Any user with Kubernetes RBAC permissions to read workflow pod logs can extract these credentials.

Recommendations Update to version 4.0.5.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BIT-ARGO-WORKFLOWS-2026-42295

CVE-2026-42295

GHSA-7VF8-2CR6-54MF

GO-2026-5235

OPENSUSE-SU-2026:21483-1

Affected Products

Argo Workflows

References · 1751

• 🔥 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42295.json · Exploit
• https://osv.dev/vulnerability/GHSA-7vf8-2cr6-54mf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42295 · Security Note
• https://osv.dev/vulnerability/GO-2026-5235 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-workflows-2026-42295 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 · Note
• https://github.com/argoproj/argo-workflows/blob/59f1089b9875723ddffd524513e6bd5cb37e5e31/workflow/artifacts/logging/driver.go#L24 · Note
• https://github.com/argoproj/argo-workflows/commit/bdd40908580f727c590c8743836e338b04fe4a87 · Note
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-c2hv-4pfj-mm2r · Note
• https://github.com/argoproj/argo-workflows · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note