{"id":"CVE-2026-28229","state":"PUBLISHED","title":"Argo Workflows has unauthorized access to Argo Workflows Template","description":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.","publishedAt":"2026-03-11T15:37:47.338Z","updatedAt":"2026-07-15T01:11:58.807Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["argoproj argo-workflows"],"affected":[{"vendor":"argoproj","product":"argo-workflows","versions":[{"version":">= 4.0.0, < 4.0.2","status":"affected"},{"version":"< 3.7.11","status":"affected"}]}],"references":["https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5","https://access.redhat.com/security/cve/CVE-2026-28229","https://bugzilla.redhat.com/show_bug.cgi?id=2446549","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28229.json","https://access.redhat.com/errata/RHSA-2026:10184"],"weaknesses":["CWE-863","CWE-306"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/28xxx/CVE-2026-28229.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-28229","state":"PUBLISHED","datePublished":"2026-03-11T15:37:47.338Z","dateUpdated":"2026-07-15T01:11:58.807Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-02-25T15:28:40.651Z"},"containers":{"cna":{"title":"Argo Workflows has unauthorized access to Argo Workflows Template","descriptions":[{"lang":"en","value":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11."}],"affected":[{"vendor":"argoproj","product":"argo-workflows","versions":[{"version":">= 4.0.0, < 4.0.2","status":"affected"},{"version":"< 3.7.11","status":"affected"}]}],"references":[{"url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5","name":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","lang":"en","description":"CWE-863: Incorrect Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-03-11T15:37:47.338Z"},"source":{"advisory":"GHSA-56px-hm34-xqj5","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-11T17:32:34.148157Z","id":"CVE-2026-28229","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-11T17:33:15.219Z"}},{"title":"argo-workflows: Argo Workflows has unauthorized access to Argo Workflows Template","descriptions":[{"lang":"en","value":"A flaw was found in Argo Workflows in which an attacker can leak sensitive information contained in Workflow Templates and Cluster Workflow Templates. Because the functions that retrieve template information use server permissions, no authorization is required to read templates which might contain secrets such as passwords, API keys, or other sensitive data."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9","defaultStatus":"affected","versions":[{"version":"1776740558","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9","defaultStatus":"affected","versions":[{"version":"1776740640","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel9","defaultStatus":"affected","versions":[{"version":"1776740726","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-ml-pipelines-driver-rhel9","defaultStatus":"affected","versions":[{"version":"1776740379","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-ml-pipelines-launcher-rhel9","defaultStatus":"affected","versions":[{"version":"1776740386","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9","defaultStatus":"affected","versions":[{"version":"1776740351","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9","defaultStatus":"affected","versions":[{"version":"1776740366","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-driver-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-launcher-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-28229","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446549","name":"RHBZ#2446549","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28229.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:11:58.807Z"},"datePublic":"2026-03-11T15:37:47.338Z","solutions":[{"lang":"en","value":"RHSA-2026:10184: Red Hat OpenShift AI 2.25"}],"timeline":[{"lang":"en","time":"2026-03-11T16:01:02.960Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-11T15:37:47.338Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}