CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials
Attackers with log access can extract plaintext artifact repository credentials from Argo Workflows executor logs, compromising cloud storage and Git access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42295?
CVE-2026-42295 is a high-severity vulnerability in argoproj argo-workflows, published on 9 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.
Weakness: CWE-522
Which versions are affected by CVE-2026-42295?
7 open source packages ship an affected version, including github.com/argoproj/argo-workflows/v4, argo-workflows and github.com/argoproj/argo-workflows. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
argo-workflows Bitnami | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows Go | All versions | None |
github.com/argoproj/argo-workflows/v2 Go | All versions | None |
1 more packages
github.com/argoproj/argo-workflows/v3 Go | All versions | None |
Products include Argoproj Argo Workflows.
How do I fix CVE-2026-42295?
Upgrade github.com/argoproj/argo-workflows/v4 to 4.0.5 or later.
Is CVE-2026-42295 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42295 exists.
Other vulnerabilities in argoproj argo-workflows
- CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template
- CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
- CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
- CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
- CVE-2025-62157 Argo Workflows exposes artifact repository credentials in workflow-controller logs
Sources
Also known as BIT-argo-workflows-2026-42295, GHSA-7vf8-2cr6-54mf, GO-2026-5235, MINI-2w2r-925g-72cr, MINI-56p6-g54v-rqqx, MINI-5828-xmpj-9jw9 and 9 more.