Skip to content
fr Sign in
7.3 High

CVE-2026-23960 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

Affected products and versions

Product Affected versions Fixed in
argo-workflows 3.7 3.7.0 → < 3.7.8 3.7.8
argo-workflows 3.6 earliest → < 3.6.17 3.6.17
Red Hat OpenShift AI (RHOAI) Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of argo-workflows

The 17 CVEs of argo-workflows →
CVE-2026-93991 Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows… 8.3 High CVE-2026-54526 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.9 High CVE-2026-42296 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.1 High CVE-2026-42295 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.5 High
Track this CVE