CVE-2022-29164 Privilege Escalation in argo-workflows

High 7.1 Published 5 May 2022 Updated 23 Apr 2025

An insider can exploit stored XSS in Argo Workflows artifacts to execute scripts as a victim, reading or modifying their workflows.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-29164?

CVE-2022-29164 is a high-severity cross-site scripting vulnerability in argoproj argo-workflows, published on 5 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions.

Weakness: CWE-269

Which versions are affected by CVE-2022-29164?

5 open source packages ship an affected version, including github.com/argoproj/argo-workflows/v3 and argo-workflows. It affects 1 product.

Package	Affected	Fixed in
`github.com/argoproj/argo-workflows/v3` Go	From `2.6.0`	`3.2.11`
`github.com/argoproj/argo-workflows/v3` Go	From `2.6.0`	`3.2.11`
`github.com/argoproj/argo-workflows/v3` Go	From `3.3.0`	`3.3.5`
`github.com/argoproj/argo-workflows/v3` Go	From `3.3.0`	`3.3.5`
`argo-workflows` Bitnami	From `2.6.0`	`3.2.11, 3.3.5`

Products include Argoproj Argo Workflows.

How do I fix CVE-2022-29164?

Upgrade github.com/argoproj/argo-workflows/v3 to a fixed version for your release line: 3.2.11 or 3.3.5.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-29164 being exploited?

There is no known exploitation of CVE-2022-29164 in the wild and no public exploit code.

Sources

Also known as BIT-argo-workflows-2022-29164, GHSA-cmv8-6362-r5w9, MINI-99q2-9328-2f2h, MINI-wv79-5jmc-xmgg.