CVE-2025-62157

What it actually does

Argo Workflows logs artifact repository credentials in plaintext inside workflow-controller pod logs, allowing any entity with pod log read access in the namespace to retrieve them.

Why it matters to the business

Organizations running Argo Workflows on Kubernetes face risk of unauthorized access to artifact storage, which can lead to data exfiltration, workflow tampering, or supply-chain compromise; the project is widely used for container orchestration so exposure is common across many environments.

How an attack unfolds

An attacker who already possesses permissions to read pod logs in a namespace running vulnerable Argo Workflows retrieves the workflow-controller logs, locates the plaintext credential strings, and re-uses those credentials to access or modify artifacts in the configured repository.

How to fix it

Upgrade argoproj/argo-workflows to version 3.6.12 or 3.7.3; the fix is contained in commit bded09fe4abd37cb98d7fc81b4c14a6f5034e9ab. No workarounds exist.

How to confirm the fix worked

After upgrade, inspect workflow-controller pod logs to confirm absence of plaintext artifact credentials; re-run representative workflows and verify log output contains no sensitive strings.

Typical attack path

1. Locate a Kubernetes namespace running Argo Workflows
2. Obtain or abuse permissions allowing pod log retrieval
3. Read workflow-controller pod logs
4. Extract artifact repository credentials from plaintext log entries
5. Authenticate to the artifact repository with the stolen credentials

How to detect it

Search Kubernetes pod logs and audit logs for workflow-controller entries that contain credential-like strings; review RBAC and access logs for unexpected pod-log read operations around the time workflows ran.

• workflow-controller
• artifact repository credentials
• plaintext credential strings in pod logs

What your security team should do

• Immediately upgrade all Argo Workflows installations to 3.6.12 or 3.7.3
• Restrict pod log read permissions to the minimum required identities
• Enable log redaction or filtering for credential patterns where supported
• Audit historical logs for any prior credential exposure