7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23960

CVE-2026-23960: Argo Workflows affected by stored XSS in the artifact directory listing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23960

CVE-2026-23960:

7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/argoproj/argo-workflows/v3	go	< 3.6.17	3.6.17
github.com/argoproj/argo-workflows/v3	go	>= 3.7.0, <= 3.7.7	3.7.8
github.com/argoproj/argo-workflows	go	<= 2.5.3-rc4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis identified a stored Cross-Site Scripting (XSS) issue within the Argo Workflows artifact server. The root cause was located in the GetArtifactFile function in server/artifacts/artifact_server.go. This function was responsible for generating an HTML directory listing for artifacts. The vulnerability stemmed from the fact that it directly used fmt.Fprintf to embed user-controlled filenames into the HTML response without proper escaping. An attacker could create a workflow that generates an artifact with a malicious filename containing JavaScript. When another user viewed the directory listing for these artifacts, the malicious script would execute in their browser under the Argo Server's origin.

The patch addresses this vulnerability by refactoring the code. The unsafe fmt.Fprintf calls for generating the listing were removed from GetArtifactFile. A new function, renderDirectoryListing, was introduced, which utilizes Go's html/template library. This library automatically handles HTML escaping, thus neutralizing the XSS vector. The GetArtifactFile function now calls renderDirectoryListing to generate the HTML for the directory listing. Additionally, a new function setSecurityHeaders was added to provide defense-in-depth by setting Content-Security-Policy and X-Frame-Options headers. The primary function that would be active during the exploitation of this vulnerability is ArtifactServer.GetArtifactFile, as it is the entry point for handling the artifact file request and generating the vulnerable response.

Vulnerable functions

ArtifactServer.GetArtifactFile

server/artifacts/artifact_server.go

The `GetArtifactFile` function was responsible for generating an HTML page for directory listings of artifacts. It used `fmt.Fprintf` to write file and directory names directly into the HTTP response. Since these names are user-controlled, an attacker could craft a filename containing malicious JavaScript. When a victim browses the artifact directory, the script would execute in their browser, leading to a stored Cross-Site Scripting (XSS) vulnerability. The patch mitigates this by introducing the `renderDirectoryListing` function, which uses the `html/template` package to safely escape the filenames before rendering them.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.