Use of Hard-coded Cryptographic Key in Argo Workflows - #VU126900
Published: August 18, 2021 / Updated: April 23, 2026
Vulnerability identifier: #VU126900
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge requests or disclose sensitive information.
The vulnerability exists due to improper certificate validation in Argo Server TLS handling when establishing secure connections. A remote attacker can extract the packaged keys and use them to forge requests or disclose sensitive information.
The issue affects deployments running Argo Server in secure mode, and exposure to the Internet makes the attack reachable from the Internet.
Affected software
Argo Workflows
Remediation
Install security update from vendor's website.
Argo Workflows - addressed in versions 2.12.12, 3.0.9, 3.1.6