Cloudanix VulnDB

CVE-2025-32445

Critical · 9.9

CVSS

9.9

EPSS

0.8%

Published

Apr 15, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the workflow automation tool allows users with limited rights to take over the entire computer cluster by tweaking how tasks run.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A user with permissions to create or modify EventSource and Sensor custom resources can specify arbitrary container configurations including securityContext, command, args, and volumeMounts, allowing the orchestrated pods to run with elevated privileges on the host system and cluster.

Why it matters to the business

Attackers can compromise the Kubernetes cluster and underlying hosts, leading to full control over workloads and data without needing admin rights, increasing risk in environments using Argo Events for workflow automation.

How an attack unfolds

An attacker with limited permissions creates a malicious EventSource or Sensor CR with customized pod template that sets privileged securityContext, mounts host paths, or runs commands as root, causing the controller to spawn a privileged pod that grants host access.

How to fix it

Upgrade argoproj/argo-events to the fixed commit 80f5951150be80996b63f7d84d092812d5ea73a3 corresponding to v1.9.6. For affected Red Hat packages update apcu-panel to 0:5.1.18-1.module+el8.3.0+6678+b09f589e and libzip to 0:1.6.1-1.module+el8.3.0+6678+b09f589e.

How to confirm the fix worked

Verify the installed version of Argo Events is v1.9.6 or later by checking deployment image tags or release notes. Review RBAC permissions for EventSource and Sensor resources to ensure least privilege.

Typical attack path

  1. Identify permissions to manage EventSource/Sensor CRs
  2. Craft malicious CR with elevated container spec including privileged securityContext or host mounts
  3. Apply the CR to trigger pod creation
  4. Use the privileged pod to access host filesystem and escalate to cluster admin

How to detect it

Inspect Kubernetes audit logs for creations or updates of EventSource and Sensor resources containing suspicious template configurations such as privileged security contexts or host volume mounts.

What your security team should do

  • Prioritize upgrade of Argo Events to v1.9.6 immediately
  • Audit and restrict permissions for creating or modifying EventSource and Sensor CRs using RBAC
  • Implement admission controls to block privileged pod specs in Argo Events resources

The record

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext , volumeMount can be specified, and applied to the EventSource or Sensor pod. With these, a user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template. This vulnerability is fixed in v1.9.6.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/argoproj/argo-events 0 1.9.6
Chainguard argo-events-fips 0 1.9.6-r0
Chainguard argo-events-fips-compat 0 1.9.6-r0
openSUSE:Tumbleweed govulncheck-vulndb 0 0.0.20250422T181640-1.1

Related vulnerabilities