GHSA-7vf8-2cr6-54mf

Опубликовано: 04 мая 2026

Источник: github

Github: Прошло ревью

CVSS4: 8.5

Описание

Argo vulnerable to exposure of artifact repository credentials

Summary

The workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials.

Note: This is an incomplete fix of CVE-2025-62157

Details

The logging driver passes the entire ArtifactDriver struct to the structured logger, for example: https://github.com/argoproj/argo-workflows/blob/59f1089b9875723ddffd524513e6bd5cb37e5e31/workflow/artifacts/logging/driver.go#L24

Exposed credential fields:

S3 (workflow/artifacts/s3/s3.go): AccessKey, SecretKey, SessionToken, ServerSideCustomerKey
OSS (workflow/artifacts/oss/oss.go): AccessKey, SecretKey, SecurityToken
GCS (workflow/artifacts/gcs/gcs.go): ServiceAccountKey

PoC

Create template

apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: name: cred-leak-test namespace: argo spec: entrypoint: main templates: - name: main container: image: alpine:3.13 command: [sh, -c] args: ["echo 'hello' > /tmp/output.txt"] outputs: artifacts: - name: output path: /tmp/output.txt s3: endpoint: minio:9000 insecure: true bucket: my-bucket key: test-output.txt accessKeySecret: name: my-minio-cred key: accesskey secretKeySecret: name: my-minio-cred key: secretkey

Then check the logs kubectl -n argo logs "cred-leak-test" -c wait

Impact

Any user with Kubernetes RBAC permissions to read pod logs in the workflow namespace can extract artifact repository credentials.

Ссылки

Пакеты

Наименование

github.com/argoproj/argo-workflows/v4

Затронутые версииВерсия исправления

>= 4.0.0, < 4.0.5

4.0.5

EPSS

Процентиль: 28%

0.00357

Низкий

8.5 High

CVSS4

CVE ID

CVE-2026-42295

Дефекты

CWE-522

Связанные уязвимости

CVE-2026-42295

CVSS3: 5.5

redhat

3 месяца назад

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.

CVE-2026-42295

CVSS3: 4.9

nvd

3 месяца назад

EPSS

Процентиль: 28%

0.00357

Низкий

8.5 High

CVSS4

CVE ID

CVE-2026-42295

Дефекты

CWE-522