-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-workflows/v3 | go | >= 3.7.0, < 3.7.3 | 3.7.3 |
| github.com/argoproj/argo-workflows/v3 | go | < 3.6.12 | 3.6.12 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability exists because the updateConfig function within the WorkflowController logs the entire application configuration, which includes sensitive credentials for the artifact repository. The analysis of the provided patches confirms this. Both commits, 18ad5138b6bcb2aba04e00b4ec657bc6b8fad8df and bded09fe4abd37cb98d7fc81b4c14a6f5034e9ab, modify the workflow/controller/config.go file. The change in both patches is the removal of the line log.Info("Configuration:\n" + string(bytes)), which was responsible for logging the marshalled configuration data. This line is replaced with a non-sensitive message, log.Info("Configuration updated"). This indicates that the updateConfig function, when called in a vulnerable version, would log the credentials, making it the primary vulnerable function. An attacker who can view the logs of the workflow-controller pod could exploit this to gain unauthorized access to the artifact repository.
WorkflowController.updateConfigworkflow/controller/config.go
Ongoing coverage of React2Shell