CVE-2024-47827 Argo Workflows Controller: Denial of Service via malicious daemon Workflows
An attacker with workflow execution access can crash the Argo Workflows controller via a race condition, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47827?
CVE-2024-47827 is a medium-severity vulnerability in argoproj argo-workflows, published on 28 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.
Which versions are affected by CVE-2024-47827?
6 open source packages ship an affected version, including github.com/argoproj/argo-workflows/v3, argo-workflows and github.com/argoproj/argo-workflows. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-workflows/v3 Go | From 3.6.0-rc1 | 3.6.0-rc2 |
github.com/argoproj/argo-workflows/v3 Go | From 3.6.0-rc1 | 3.6.0-rc2 |
github.com/argoproj/argo-workflows/v3 Go | From 3.6.0-rc1 | 3.6.0-rc2 |
argo-workflows Bitnami | From 3.6.0-rc1 | 3.6.0-rc2 |
github.com/argoproj/argo-workflows Go | All versions | None |
github.com/argoproj/argo-workflows/v2 Go | All versions | None |
Products include Argoproj Argo Workflows.
How do I fix CVE-2024-47827?
Upgrade github.com/argoproj/argo-workflows/v3 to 3.6.0-rc2 or later.
Is CVE-2024-47827 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47827 exists.
Other vulnerabilities in argoproj argo-workflows
- CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template
- CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
- CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
- CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials
- CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Sources
Also known as BIT-argo-workflows-2024-47827, GHSA-ghjw-32xw-ffwr, GO-2024-3226.