Skip to content
fr Sign in
9.8 Critical

CVE-2026-28229 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift AI 2.25 1776740366 earliest → < 1776740366 1776740366
Red Hat OpenShift AI (RHOAI) Versions not published
argo-workflows 4.0 4.0.0 → < 4.0.2 4.0.2
argo-workflows 3.7 earliest → < 3.7.11 3.7.11

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift AI 2.25

The 140 CVEs of Red Hat OpenShift AI 2.25 →
CVE-2026-86332 A flaw was found in odh-dashboard in Red Hat OpenShift AI 6.5 Medium CVE-2026-18620 A flaw was found in Data Science Pipelines 7.1 High CVE-2026-18618 A flaw was found in ml-metadata 7.5 High CVE-2026-18611 A flaw was found in the Data Science Pipelines Operator 7.5 High
Track this CVE