Описание
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
A flaw was found in Argo Workflows in which an attacker can leak sensitive information contained in Workflow Templates and Cluster Workflow Templates. Because the functions that retrieve template information use server permissions, no authorization is required to read templates which might contain secrets such as passwords, API keys, or other sensitive data.
Отчет
An Important flaw was found in Argo Workflows, as used in Red Hat OpenShift AI. This vulnerability allows an attacker to gain unauthorized access to Workflow Templates and Cluster Workflow Templates due to insufficient authorization checks. This could lead to the disclosure of sensitive information, including embedded secrets like passwords and API keys.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-api-server-v2-rhel8 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-driver-rhel8 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-launcher-rhel8 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8 | Not affected | ||
| Red Hat OpenShift AI 2.25 | rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 | Fixed | RHSA-2026:10184 | 23.04.2026 |
| Red Hat OpenShift AI 2.25 | rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 | Fixed | RHSA-2026:10184 | 23.04.2026 |
| Red Hat OpenShift AI 2.25 | rhoai/odh-ml-pipelines-api-server-v2-rhel9 | Fixed | RHSA-2026:10184 | 23.04.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
EPSS
7.5 High
CVSS3