Use of Hard-coded Cryptographic Key in Argo Workflows - #VU126900
Published: August 18, 2021 / Updated: April 23, 2026
Vulnerability identifier: #VU126900
CSH Severity: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Argo Workflows
Argo Workflows
Software vendor:
Argo
Argo
Description
The vulnerability allows a remote attacker to forge requests or disclose sensitive information.
The vulnerability exists due to improper certificate validation in Argo Server TLS handling when establishing secure connections. A remote attacker can extract the packaged keys and use them to forge requests or disclose sensitive information.
The issue affects deployments running Argo Server in secure mode, and exposure to the Internet makes the attack reachable from the Internet.
Remediation
Install security update from vendor's website.