PUBLISHED
2025-10-14 15:16
MODIFIED
2025-10-14 19:36
EPSS (Prob. Exploit)
0.47%
Top 60.6%
> DESCRIPTION
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> RED HAT SEVERITY ASSESSMENT
> GITHUB SECURITY ADVISORY
GHSA-c2hv-4pfj-mm2r
HIGH
Argo Workflow may expose artifact repository credentials
AFFECTED PACKAGES:
GO / github.com/argoproj/argo-workflows/v3
< 3.6.12
Fixed in: 3.6.12
GO / github.com/argoproj/argo-workflows/v3
>= 3.7.0, < 3.7.3
Fixed in: 3.7.3
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Argo Workflows exposes artifact repository credentials in workflow-controller logs
AFFECTED PACKAGES:
Unknown / Unknown
56 versions affected
ALIASES:
BIT-argo-workflows-2025-62157, GHSA-c2hv-4pfj-mm2r, GO-2025-4024
> HISTORIQUE DES MODIFICATIONS
Première apparition
14/10/2025 15:16
Source: NVD
📊
ENRICHISSEMENT
19/10/2025 04:01
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Moderate"
}
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
18/10/2025 12:03
REDHAT
Champ modifié: Sévérité Red Hat
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
18/10/2025 12:03
REDHAT
Total des modifications: 4
Dernière mise à jour: 1 year ago