CVE-2026-23960
Medium · 5.4CVSS
5.4
EPSS
0.4%
Published
Jan 21, 2026
CISA due date
—
The record
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/argoproj/argo-workflows | 0 | No fix |
| Go | github.com/argoproj/argo-workflows/v2 | 0 | No fix |
| Go | github.com/argoproj/argo-workflows/v3 | 0 | 3.6.17 |
| Go | github.com/argoproj/argo-workflows/v3 | 3.7.0 | 3.7.8 |
| Bitnami | argo-workflows | 0 | 3.6.17 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 3.7.8-r0 |
| Chainguard | argo-workflow-controller-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflow-controller-fips-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.8-r0 |
| Chainguard | argo-workflow-executor-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.8-r0 |
| Chainguard | argo-workflows-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflows-fips-4.0 | 0 | 4.0.2-r0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 | 2.15.0-r8 |
| Chainguard | kubeflow-pipelines-cache_server | 0 | 2.15.0-r8 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r8 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r8 |
| Wolfi | argo-workflow-controller-3.7 | 0 | 3.7.8-r0 |
| Wolfi | argo-workflow-controller-4.0 | 0 | 4.0.2-r0 |
| Wolfi | argo-workflow-executor-3.7 | 0 | 3.7.8-r0 |
| Wolfi | argo-workflow-executor-4.0 | 0 | 4.0.2-r0 |
| Wolfi | argo-workflows-3.7 | 0 | 3.7.8-r0 |
| Wolfi | argo-workflows-4.0 | 0 | 4.0.2-r0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 | 2.15.0-r8 |
| Wolfi | kubeflow-pipelines-cache_server | 0 | 2.15.0-r8 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r8 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r8 |
| go | github.com/argoproj/argo-workflows/v3 | 3.7.0 | 3.7.8 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- CVE-2025-66626 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links Also affects github.com/argoproj/argo-workflows
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects argo-workflow-controller-3.7
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects argo-workflow-controller-3.7
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects argo-workflow-controller-3.7
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects argo-workflow-controller-3.7
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects argo-workflow-controller-3.7
- CVE-2026-24051 OpenTelemetry-Go is the Go implementation of OpenTelemetry. Also affects argo-workflow-controller-3.7
- GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion Also affects argo-workflow-controller-3.7