Is github.com/argoproj/argo-workflows safe ? github.com/argoproj/argo-workflows (go) has 19 known vulnerabilities, the worst rated HIGH. No malicious-package signal is recorded.
// reach 5 direct dependencies
3 carry known advisories, worst CRITICAL
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v4.0 base score out of 10
epss chance of exploitation in 30 days, 47th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-48p8-g2fx-3wwm, the advisory selected below
// 19 advisories GHSA-48p8-g2fx-3wwm The allow-list fix for CVE-2026-31892 (GHSA-3wf5-g532-rcrr), and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in… HIGH GHSA-3wf5-g532-rcrr A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow… HIGH GHSA-cv78-6m8q-ph82 Stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin… HIGH GHSA-xrqc-7xgx-c9vh The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. HIGH GHSA-rc7p-gmvh-xfx2 Users running using the Argo Server with --auth-mode=server (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to… MODE GHSA-xchc-cqwg-g76q Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows UNKN GHSA-7vf8-2cr6-54mf Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows UNKN GHSA-p4gq-3vxj-f4jq Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows UNKN GHSA-5jv8-h7qh-rf5p Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows UNKN GHSA-3775-99mw-8rp4 Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in… UNKN Show all 19 advisories The allow-list fix for CVE-2026-31892 (GHSA-3wf5-g532-rcrr), and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in…
Full advisory text at GitHub advisory or NVD .
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Attack vector Network
Attack complexity Low
Attack requirements Present
Privileges required Low
User interaction None
Confidentiality (vulnerable system) High
Integrity (vulnerable system) High
Availability (vulnerable system) None
Confidentiality (subsequent systems) High
Integrity (subsequent systems) High
Availability (subsequent systems) High // questions Is github.com/argoproj/argo-workflows safe to install? CyberXYZ does not call a package safe in absolute terms. It records 19 known vulnerabilities for github.com/argoproj/argo-workflows (go), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/argoproj/argo-workflows have known vulnerabilities? Yes. CyberXYZ records 19 known vulnerabilities for github.com/argoproj/argo-workflows (go), the worst rated HIGH. These include GHSA-48p8-g2fx-3wwm, GHSA-3wf5-g532-rcrr, GHSA-cv78-6m8q-ph82, GHSA-xrqc-7xgx-c9vh, GHSA-rc7p-gmvh-xfx2.
How do I check github.com/argoproj/argo-workflows before installing? Search github.com/argoproj/argo-workflows in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fargoproj%2Fargo-workflows . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:45 UTC. The most recent advisory here was published 2026-08-13. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page