CVE-2025-32445 Details
Description
Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext , volumeMount can be specified, and applied to the EventSource or Sensor pod. With these, a user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template. This vulnerability is fixed in v1.9.6.
A vulnerability in Argo Events allows users with permission to create or modify EventSource and Sensor custom resources to gain privileged access to the host system and Kubernetes cluster. This issue arises from the ability to customize the orchestrated pod's specification, including sensitive properties such as the security context, volume mounts, and commands executed within the container. Exploitation of this vulnerability could lead to unauthorized access to cluster resources and host-level privileges, bypassing standard security models and controls.
Users can upgrade to Argo Events version 1.9.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 15, 2025CISA-ADP
Assessed Apr 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/argoproj/argo-events/commit/18412293a699f559848b00e6e459c9ce2de0d3e2 | [email protected] | Source CodeVendor |
| https://github.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Argo Events | < v1.9.6 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2025 | New CVE Received | [email protected] |