CVE-2026-28229: argoproj argo_workflows Incorrect Authorization
Vulnerability summary
CVE-2026-28229 is a critical (CVSS 9.8) Incorrect Authorization vulnerability in argoproj argo_workflows. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 11-03-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.81%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.16 pp
From 0.65% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundArgo Workflows
Maturity: poc
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Chainguard10 products
- argo-workflow-controller-3.6< 3.6.19-r6
- argo-workflow-controller-fips-3.6< 3.6.19-r8
- argo-workflow-executor-3.6< 3.6.19-r6
- argo-workflow-executor-fips-3.6< 3.6.19-r8
- argo-workflows-3.6< 3.6.19-r6
Wolfi4 products
- kubeflow-pipelines-apiserver< 2.16.0-r4
- kubeflow-pipelines-cache_server< 2.16.0-r4
- kubeflow-pipelines-persistence_agent< 2.16.0-r4
- kubeflow-pipelines-scheduledworkflow< 2.16.0-r4
Github.com/argoproj/argo-workflows3 products
- v2All versions (No fix recorded)
- v3≥ 3.7.0, < 3.7.11 | < 3.7.11
- v4< 4.0.2
Argoproj2 products
- argo_workflows≥ 3.7.0, < 3.7.11 | ≥ 4.0.0, < 4.0.2
- argo-workflows≥ 4.0.0, < 4.0.2 | < 3.7.11
Github.com/argoproj1 product
- argo-workflowsAll versions (No fix recorded)
5 vendors · 20 products
References
11 links- github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5X Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
