8.5
High
CVE-2025-62157 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| argo-workflows 3.7 | 3.7.0 → < 3.7.3 | 3.7.3 |
| argo-workflows 3.6 | earliest → < 3.6.12 | 3.6.12 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of argo-workflows
The 17 CVEs of argo-workflows →
CVE-2026-93991
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows…
8.3
High
CVE-2026-54526
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
8.9
High
CVE-2026-42296
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
8.1
High
CVE-2026-42295
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
8.5
High