PT-2026-3870 · Unknown · Argo Workflows
CVSS v4.0
7.3
High
| Vector | AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Argo Workflows versions prior to 3.6.17 and prior to 3.7.8
Description
Argo Workflows contains a stored cross-site scripting (XSS) issue in the artifact directory listing. This allows a workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, potentially enabling API actions with the victim’s privileges. The issue stems from the directory listing response in
server/artifacts/artifact server.go rendering object names directly into HTML without proper escaping. Object names are attacker-controlled when a workflow writes files into an output artifact directory. The vulnerable code is located at fmt.Fprintf within the specified file. An attacker can create a malicious workflow that produces a crafted HTML artifact containing a script. By sending a deep-link to this artifact to a victim, the attacker can execute the script in the victim's browser, potentially allowing the attacker to perform actions on the Argo Server API with the victim’s permissions, such as reading workflow information or creating/deleting workflows.Recommendations
Argo Workflows versions prior to 3.6.17 should be updated to version 3.6.17 or later.
Argo Workflows versions prior to 3.7.8 should be updated to version 3.7.8 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Argo Workflows