Argo Workflows (workflow-controller, artifact repository credential logging): Workflow-controller writes artifact

Impact

Workflow-controller writes artifact repository credentials into its own logs in plaintext. Anyone who can read pod logs in the Argo namespace - a monitoring sidecar, an on-call engineer, a tenant with over-broad RBAC - gets full read/write/delete on the shared artifact bucket that holds every tenant's inputs, checkpoints and outputs.

Who can reach it

A principal with get on pods/log for the workflow-controller pod, or read access to whatever log pipeline collects it.

What to do

Upgrade to 3.6.12 or 3.7.3 and restart the controller, then rotate the artifact repository credentials. Note the sibling CVE-2026-42295 covers the same leak in the executor, so patch both before declaring the credentials clean.

References