Known vulnerabilities in Argo Workflows

Vendor: Argo
Software CPE: cpe:2.3:a:argo:argo-workflows:*:*:*:*:*:*:*:*
Total vulnerabilities: 18
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Argo Workflows Argo Workflows is affected by 18 known vulnerabilities: 1 high, 9 medium, 8 low Critical High Medium Low

Vulnerabilities (18)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU126911 - Resource exhaustion
CVE-2026-42294
CWE-400 Medium
No
No
3.7.14, 4.0.5 23.04.2026 SB2026042339
#VU126910 - Insufficiently Protected Credentials
CVE-2026-42295
CWE-522 Low
No
No
4.0.5 23.04.2026 SB2026042339
#VU126909 - Incorrect Authorization
CVE-2026-42296
CWE-863 Medium
No
No
3.7.14, 4.0.5 23.04.2026 SB2026042339
#VU126908 - Improper Validation of Array Index
CVE-2026-40886
CWE-129 Low
No
No
3.7.14, 4.0.5 23.04.2026 SB2026042339
#VU126907 - Missing Authorization
CVE-2026-42297
CWE-862 Medium
No
No
4.0.5 23.04.2026 SB2026042339
#VU126906 - NULL Pointer Dereference
CVE-2026-42183
CWE-476 Low
No
No
4.0.5 23.04.2026 SB2026042339
#VU126905 - Incorrect Authorization
CVE-2026-31892
CWE-863 Medium
No
No
3.7.11, 4.0.2 23.04.2026 SB2026042338
#VU126904 - Improper Access Control
CVE-2026-28229
CWE-284 Medium
No
No
3.7.11, 4.0.2 23.04.2026 SB2026042338
#VU126897 - Insufficiently Protected Credentials
CVE-2025-62157
CWE-522 Low
No
No
3.6.12, 3.7.3 23.04.2026 SB2025120924
#VU126896 - Relative Path Traversal
CVE-2025-66626
CWE-23 Medium
No
No
3.6.14, 3.7.5 23.04.2026 SB2026042337
#VU121958 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-23960
CWE-79 Low
Available
No
3.6.17, 3.7.8 23.01.2026 SB2026012306
#VU119403 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-62156
CWE-22 Medium
No
No
3.6.12, 3.7.3 09.12.2025 SB2025120924
SB2025120925
#VU126898 - Missing Authorization
CVE-2024-53862
CWE-862 Medium
No
No
3.5.13, 3.6.2 02.12.2024 SB2024120237
#VU126899 - Improper Access Control
CVE-2022-29164
CWE-284 Low
No
No
3.2.11, 3.3.5 04.05.2022 SB2022050458
#VU126900 - Use of Hard-coded Cryptographic Key
CWE-321 High
No
No
2.12.12, 3.0.9, 3.1.6 18.08.2021 SB2021080414
#VU126901 - Improper Access Control
CWE-284 Low
No
No
2.12.12, 3.0.9, 3.1.6 18.08.2021 SB2021080414
#VU126902 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 Low
No
No
3.1.6 04.08.2021 SB2021080414
#VU126903 - Improper Access Control
CWE-284 Medium
No
No
3.0.0 22.07.2021 SB20210722101