CVE-2026-28229 Details
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
A vulnerability in Argo Workflows prior to versions 4.0.2 and 3.7.11 allows unauthorized access to WorkflowTemplates and ClusterWorkflowTemplates. The issue arises because the Workflow templates endpoints can be accessed by any client with a request that includes an 'Authorization: Bearer nothing' token. This access can lead to the leakage of sensitive template content, such as embedded Secret manifests. The vulnerability is present in versions prior to 3.7.11 and in the 4.0.0 series, prior to 4.0.2.
Users can upgrade to Argo Workflows versions 4.0.2 or 3.7.11 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:10184 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-28229 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2446549 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28229.json | redhat-SADP | |
| https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | redhat-SADP |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| argoproj argo workflows | >= 3.7.0, < 3.7.11 >= 4.0.0, < 4.0.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | Reanalysis | [email protected] |
| Mar 20, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |