CVE-2025-62157: Argo Workflows exposes artifact repository credentials in workflow-controller logs
Summary An attacker who has permissions to read logs from pods in a namespace with Argo Workflow can read workflow-controller logs and get credentials to the artifact repository.
Details An attacker, by reading the logs of the workflow controller pod, can access the artifact repository, and steal, delete or modify the data that resides there. The workflow-controller logs show the credentials in plaintext.
<img width="1366" alt="screen" src="https://github.com/user-attachments/assets/5642b2be-edcf-4050-bf47-747d05352698" />
Impact An attacker with access to pod logs in the argo namespace can extract plaintext credentials from the workflow-controller logs and gain access to the artifact repository. This can lead to: - Data exfiltration – theft of sensitive or proprietary artifacts - Data tampering – modification of workflows or artifacts - Data destruction – deletion of stored artifacts, leading to potential loss of critical data or pipeline failure
Other sources
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62157?
CVE-2025-62157 is rated as a high severity vulnerability due to the exposure of sensitive credentials in plaintext.
How do I fix CVE-2025-62157?
To remediate CVE-2025-62157, upgrade Argo Workflows to version 3.6.12 or later, or to version 3.7.3 and above.
What systems are affected by CVE-2025-62157?
CVE-2025-62157 affects Argo Workflows versions prior to 3.6.12 and between 3.7.0 and 3.7.2.
What type of vulnerability is CVE-2025-62157?
CVE-2025-62157 is a credential exposure vulnerability that reveals artifact repository credentials in logs.
What risks does CVE-2025-62157 pose to users?
CVE-2025-62157 may allow attackers to gain unauthorized access to the artifact repositories by exploiting the exposed plaintext credentials.