CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28229.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Git / github.com/argoproj/argo-workflows

Affected ranges

Type

GIT

Repo

https://github.com/argoproj/argo-workflows

Events

Introduced

d1d689b367c4c8a5a8a095ae60b5d7043f99eda9

Fixed

8aad740bb4fb4698f0463e2106d8e1dfafbe72cd

Introduced

a8bff4a72130bc1a13d95c6f73ff3fafec880287

Fixed

32afec3c401c0920517bf1e890fa7dba6170cdf2

Database specific

{
    "cpe": "cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "3.7.11"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.2"
        }
    ]
}

Affected versions

v3.*

v3.7.0

v3.7.0-rc4

v3.7.1

v3.7.10

v3.7.2

v3.7.3

v3.7.4

v3.7.5

v3.7.6

v3.7.7

v3.7.8

v3.7.9

v4.*

v4.0.0

v4.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28229.json"