Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-workflows | >= 3.7.0, < 3.7.3, < 3.6.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20251105T184115-1.1 | openSUSE-SU-2025:15710-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-3.7 +3 | 3.7.3-r0 | — |
| Wolfi rolling | argo-workflows-4.0 +2 | 4.0.2-r0 | — |
| Wolfi rolling | kubeflow-pipelines +11 | 2.14.3-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-workflows | all versions | — | GO-2025-4024 |
| Go | github.com/argoproj/argo-workflows/v2 | all versions | — | GO-2025-4024 |
| Go | github.com/argoproj/argo-workflows/v3 | >= 3.7.0, < 3.7.3 | 3.7.3 | GHSA-c2hv-4pfj-mm2r |
| Go | github.com/argoproj/argo-workflows/v3 | < 3.6.12 | 3.6.12 | GHSA-c2hv-4pfj-mm2r |
| Go | github.com/argoproj/argo-workflows/v3 | < 3.6.12 · >= 3.7.0, < 3.7.3 | 3.6.12, 3.7.3 | GO-2025-4024 |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2025:15710-1 govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026