← Retour aux CVEs

CVE-2026-23960

MEDIUM

5.4

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

Details CVE

Score CVSS v3.15.4

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurREQUIRED

Publie1/21/2026

Derniere modification2/17/2026

Sourcenvd

Observations honeypot0

Produits affectes

argoproj:argo_workflows

Faiblesses (CWE)

CWE-79

References

https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244(security-advisories@github.com)

https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17(security-advisories@github.com)

https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17(security-advisories@github.com)

https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8(security-advisories@github.com)

https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82(security-advisories@github.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.