CVE-2026-23960: fallo de gravedad alta en argoproj argo-workflows
Argo Workflows affected by stored XSS in the artifact directory listing
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.3epss 0.4%
probabilidad de explotación
0.4%top 67% de las CVE
explotación observada
noninguna fuente lo reporta
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
argoproj · argo-workflowsCVEs relacionadas — argoproj argo-workflows
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-29164HIGHPrivilege Escalation in argo-workflowsEPSS 0.9%CVE-2026-28229CRITICALArgo Workflows has unauthorized access to Argo Workflows TemplateEPSS 0.8%CVE-2026-42294HIGHArgo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorEPSS 0.7%CVE-2025-66626HIGHargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic linksEPSS 0.7%CVE-2024-53862MEDIUMArgo Workflows Allows Access to Archived Workflows with Fake Token in `client` modeEPSS 0.7%CVE-2026-31892HIGHWorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference ModeEPSS 0.7%
Referencias
https://access.redhat.com/security/cve/CVE-2026-23960https://bugzilla.redhat.com/show_bug.cgi?id=2431881https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23960.json