CVE-2026-28229
Critical · 9.8CVSS
9.8
EPSS
0.8%
Published
Mar 11, 2026
CISA due date
—
The record
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | kubeflow-pipelines-apiserver | 0 | 2.16.0-r4 |
| Chainguard | kubeflow-pipelines-cache_server | 0 | 2.16.0-r4 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 | 2.16.0-r4 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-apiserver | 0 | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-cache_server | 0 | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 | 2.16.0-r4 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 | 2.16.0-r4 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260317T205859-150000.1.152.1 |
Related vulnerabilities
- CVE-2026-25645 Requests is a HTTP library. Also affects kubeflow-pipelines-apiserver
- CVE-2026-30922 pyasn1 is a generic ASN.1 library for Python. Also affects kubeflow-pipelines-apiserver
- CVE-2026-31892 Argo Workflows is an open source container-native workflow engine for orchestrating… Also affects kubeflow-pipelines-apiserver
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects kubeflow-pipelines-apiserver
- CVE-2026-26007 cryptography is a package designed to expose cryptographic primitives and recipes to… Also affects kubeflow-pipelines-apiserver
- CVE-2026-23960 Argo Workflows is an open source container-native workflow engine for orchestrating… Also affects kubeflow-pipelines-apiserver
- CVE-2026-23490 pyasn1 is a generic ASN.1 library for Python. Also affects kubeflow-pipelines-apiserver
- CVE-2026-21441 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) Also affects kubeflow-pipelines-apiserver