Known vulnerabilities in Argo Workflows

Vendor: Argo
Software CPE: cpe:2.3:a:argo:argo-workflows:*:*:*:*:*:*:*:*
Total vulnerabilities: 21
Public exploits: 1
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Argo Workflows Argo Workflows is affected by 21 known vulnerabilities: 1 high, 11 medium, 9 low Critical High Medium Low

Vulnerabilities (21)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151675 - Authorization Bypass Through User-Controlled Key
CVE-2026-93991
CWE-639 Low
No
No
4.1.4 22.09.2026 SB2026092279
#VU151674 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
4.0.12, 4.1.4 22.09.2026 SB2026092279
#VU151673 - Improper Access Control
CVE-2026-54526
CWE-284 Medium
No
No
3.7.15, 4.0.6 22.09.2026 SB2026092278
#VU126911 - Resource exhaustion
CVE-2026-42294
CWE-400 Medium
No
No
3.7.14, 4.0.5 23.04.2026 SB2026042339
#VU126910 - Insufficiently Protected Credentials
CVE-2026-42295
CWE-522 Low
No
No
4.0.5 23.04.2026 SB2026042339
#VU126909 - Incorrect Authorization
CVE-2026-42296
CWE-863 Medium
No
No
3.7.14, 4.0.5 23.04.2026 SB2026042339
#VU126908 - Improper Validation of Array Index
CVE-2026-40886
CWE-129 Low
No
No
3.7.14, 4.0.5 23.04.2026 SB2026042339
#VU126907 - Missing Authorization
CVE-2026-42297
CWE-862 Medium
No
No
4.0.5 23.04.2026 SB2026042339
#VU126906 - NULL Pointer Dereference
CVE-2026-42183
CWE-476 Low
No
No
4.0.5 23.04.2026 SB2026042339
#VU126905 - Incorrect Authorization
CVE-2026-31892
CWE-863 Medium
No
No
3.7.11, 4.0.2 23.04.2026 SB2026042338
#VU126904 - Improper Access Control
CVE-2026-28229
CWE-284 Medium
No
No
3.7.11, 4.0.2 23.04.2026 SB2026042338
#VU126897 - Insufficiently Protected Credentials
CVE-2025-62157
CWE-522 Low
No
No
3.6.12, 3.7.3 23.04.2026 SB2025120924
#VU126896 - Relative Path Traversal
CVE-2025-66626
CWE-23 Medium
No
No
3.6.14, 3.7.5 23.04.2026 SB2026042337
#VU121958 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-23960
CWE-79 Low
Available
No
3.6.17, 3.7.8 23.01.2026 SB2026012306
#VU119403 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-62156
CWE-22 Medium
No
No
3.6.12, 3.7.3 09.12.2025 SB2025120924
SB2025120925
#VU126898 - Missing Authorization
CVE-2024-53862
CWE-862 Medium
No
No
3.5.13, 3.6.2 02.12.2024 SB2024120237
#VU126899 - Improper Access Control
CVE-2022-29164
CWE-284 Low
No
No
3.2.11, 3.3.5 04.05.2022 SB2022050458
#VU126900 - Use of Hard-coded Cryptographic Key
CWE-321 High
No
No
2.12.12, 3.0.9, 3.1.6 18.08.2021 SB2021080414
#VU126901 - Improper Access Control
CWE-284 Low
No
No
2.12.12, 3.0.9, 3.1.6 18.08.2021 SB2021080414
#VU126902 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 Low
No
No
3.1.6 04.08.2021 SB2021080414


Showing elements 1 - 20 out of 21