Database/Container, Kubernetes & orchestration

Argo Workflows (Argo Server, HTML artifact serving): A workflow can emit an HTML artifact containing script that, when

CVE-2022-29164Container, Kubernetes & orchestrationGHSA-cmv8-6362-r5w9curated

Impact

A workflow can emit an HTML artifact containing script that, when a victim opens the artifact deep link, runs on the Argo Server origin and drives the API through XHR with the victim's session. A low-privilege tenant escalates to whatever an admin who clicks the link can do - create workflows, read templates and secrets, delete other tenants' work.

Who can reach it

A tenant with workflow-submit rights produces the artifact and gets a higher-privileged user to open its link, typically by email.

What to do

Upgrade Argo Server to 3.2.11 or 3.3.5 and restart. Serve artifacts from a separate origin or object-store domain rather than the Argo Server domain wherever possible, so a malicious artifact cannot borrow the UI's session.

References

https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cmv8-6362-r5w9 https://nvd.nist.gov/vuln/detail/CVE-2022-29164

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.