Database/Container, Kubernetes & orchestration

Argo Workflows (Argo Server, WorkflowTemplate / ClusterWorkflowTemplate endpoints): The template endpoints serve

CVE-2026-28229Container, Kubernetes & orchestrationGHSA-56px-hm34-xqj5curated

Impact

The template endpoints serve WorkflowTemplates and ClusterWorkflowTemplates to any caller sending an arbitrary Authorization header - literally 'Bearer nothing' works, because the handlers read from a shared informer instead of the caller's identity. Templates routinely embed Secret manifests, registry credentials and internal endpoints, so this hands an outsider the platform team's operational secrets and a full map of every tenant's pipeline.

Who can reach it

Anyone with network reach to the Argo Server API. Any garbage token satisfies the check.

What to do

Upgrade Argo Server to 3.7.11 or 4.0.2 and restart. Then rotate every credential that appears inside a WorkflowTemplate or ClusterWorkflowTemplate, since exposure leaves no distinguishing log entry.

References

https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5 https://nvd.nist.gov/vuln/detail/CVE-2026-28229

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.