{"cve":"CVE-2026-42295","nvd":{"published":"2026-05-09T04:16:25.367","modified":"2026-07-24T21:10:00.143","status":"Analyzed","description":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.5},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9},"cwes":["CWE-522"],"references":["https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5","https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf","https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf"],"products":["argoproj:argo_workflows"],"source":"nvd","synced_at":"2026-10-19T22:33:55.586217763+00:00"},"epss":{"cve":"CVE-2026-42295","score":0.00357,"percentile":0.29454,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-7vf8-2cr6-54mf","url":"https://osv.dev/vulnerability/GHSA-7vf8-2cr6-54mf","summary":"Argo vulnerable to exposure of artifact repository credentials","modified":"2026-09-10T03:50:46.312822621Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v4","purl":"pkg:golang/github.com/argoproj/argo-workflows/v4","ranges":[">=4.0.0 <4.0.5"],"fixed":["4.0.5"]}]},{"id":"GO-2026-5235","url":"https://osv.dev/vulnerability/GO-2026-5235","summary":"Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows","modified":"2026-07-02T14:44:22.829221410Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows","purl":"pkg:golang/github.com/argoproj/argo-workflows","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v2","purl":"pkg:golang/github.com/argoproj/argo-workflows/v2","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v3","purl":"pkg:golang/github.com/argoproj/argo-workflows/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v4","purl":"pkg:golang/github.com/argoproj/argo-workflows/v4","ranges":[">=4.0.0 <4.0.5"],"fixed":["4.0.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}