CVE-2026-42295

Argo Workflows: Exposure of artifact repository credentials

CVSS 8.5 HIGHEPSS 0.4%CWE-522

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

09 mai 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

argoproj · argo-workflows

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf