CVE-2026-28229CWE-863

Argo Workflows has unauthorized access to Argo Workflows Template

Critical · published March 11, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00813 · 56.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-11T15:37Z
EPSS history
Timeline
  • 11 MAR 15:37Z
    Argo Workflows has unauthorized access to Argo Workflows Template
    cvelistv5