REDHAT-BUG-2446549: High severity Argo Argo Workflows vulnerability
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Argo Workflowsto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
Argo Workflowsto a version that resolves this vulnerability.Fixed in 3.7.11
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2446549?
The severity of REDHAT-BUG-2446549 is high, rated at 7.
How do I fix REDHAT-BUG-2446549?
To fix REDHAT-BUG-2446549, update Argo Workflows to version 4.0.2 or 3.7.11 or later.
What is the nature of the vulnerability in REDHAT-BUG-2446549?
REDHAT-BUG-2446549 allows unauthorized clients to retrieve WorkflowTemplates and ClusterWorkflowTemplates due to insufficient authentication checks.
Which versions of Argo Workflows are affected by REDHAT-BUG-2446549?
REDHAT-BUG-2446549 affects Argo Workflows versions prior to 4.0.2 and 3.7.11.
What impact does REDHAT-BUG-2446549 have on Kubernetes environments?
The impact of REDHAT-BUG-2446549 allows unauthorized access to workflow configurations, potentially compromising data and job integrity.