CVE-2026-28229
Fixed in a distro release EPSS <1%CVSS 9.8
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
Products: argoproj argo-workflows, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI (RHOAI)
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/argoproj/argo-workflows | no fix |
| Go | github.com/argoproj/argo-workflows/v2 | no fix |
| Go | github.com/argoproj/argo-workflows/v3 | 3.7.11 |
| Go | github.com/argoproj/argo-workflows/v4 | 4.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-workflow-controller-3.6 | 3.6.19-r6 |
| Chainguard | argo-workflow-controller-fips-3.6 | 3.6.19-r8 |
| Chainguard | argo-workflow-executor-3.6 | 3.6.19-r6 |
| Chainguard | argo-workflow-executor-fips-3.6 | 3.6.19-r8 |
| Chainguard | argo-workflows-3.6 | 3.6.19-r6 |
| Chainguard | argo-workflows-fips-3.6 | 3.6.19-r8 |
| Chainguard | kubeflow-pipelines-apiserver | 2.16.0-r4 |
| Chainguard | kubeflow-pipelines-cache_server | 2.16.0-r4 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.16.0-r4 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-apiserver | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-cache_server | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.16.0-r4 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260317T205859-150000.1.152.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |