CVE-2021-37914: Input Validation
In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Argo Workflows through 3.1.3, disable EXPRESSION_TEMPLATES to prevent expression template output from being evaluated when untrusted users can supply workflow input parameters.
Argo Workflows EXPRESSION_TEMPLATES = disable (set to off)
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37914?
CVE-2021-37914 is considered a medium severity vulnerability.
How do I fix CVE-2021-37914?
To mitigate CVE-2021-37914, disable EXPRESSION_TEMPLATES or restrict input parameters to trusted users.
What components are affected by CVE-2021-37914?
CVE-2021-37914 affects Argo Workflows versions up to and including 3.1.3.
What attack vector is associated with CVE-2021-37914?
CVE-2021-37914 can be exploited when untrusted users are allowed to specify input parameters for workflows.
What type of impact can CVE-2021-37914 have on workflows?
CVE-2021-37914 may allow an attacker to disrupt workflow execution through evaluated expression template outputs.