CVE-2026-28229

Critical · CVSS 9.8

Argo Workflows — Improper Authorization / Missing Authentication for Critical Function (WorkflowTemplate endpoint unauthenticated information disclosure)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-863, CWE-306

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.

Search profile — drives PoC discovery

Symbols WorkflowTemplatesClusterWorkflowTemplatesAuthorization: Bearer nothingWorkflowTemplate endpointsSecret manifests/api/v1/workflow-templates/apis/argoproj.io/v1alpha1/workflowtemplatesclusterworkflowtemplates

Keywords CVE-2026-28229Argo Workflows unauthenticated WorkflowTemplateArgo Workflows information disclosureGHSA-56px-hm34-xqj5Bearer nothing token ArgoWorkflowTemplate Secret leakArgo Workflows CWE-863 CWE-306Argo Workflows authorization bypass template

Versions: < 3.7.11, >= 4.0.0 < 4.0.2

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

argoproj/argo-workflows valid MVP

containerized · known researcher · cited in references

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T00:30:14.000Z