CVSS 3.1
4.8 mediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2024-47827
Medium (4.8) in argoproj argo workflows. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/argoproj/argo-workflows/v3 3.6.0-rc2.
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-362, CWE-1108
- Published
- Modified
- Record from
- the NVD, synced
Affected
- argoproj:argo_workflows
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ghjw-32xw-ffwr | Go | github.com/argoproj/argo-workflows/v3 | >=3.6.0-rc1 <3.6.0-rc2 | 3.6.0-rc2 |
| GO-2024-3226 | Go | github.com/argoproj/argo-workflows | all versions | no fix published |
| GO-2024-3226 | Go | github.com/argoproj/argo-workflows/v2 | all versions | no fix published |
| GO-2024-3226 | Go | github.com/argoproj/argo-workflows/v3 | >=3.6.0-rc1 <3.6.0-rc2 | 3.6.0-rc2 |
References
- https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75
- https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a
- https://github.com/argoproj/argo-workflows/pull/13641
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr