9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28229

CVE-2026-28229: Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28229

CVE-2026-28229:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/argoproj/argo-workflows/v3	go	< 3.7.11	3.7.11
github.com/argoproj/argo-workflows/v4	go	< 4.0.2	4.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-56px-hm34-xqj5, allows unauthorized access to Argo Workflows Templates. The root cause is the absence of authorization checks in the gRPC server handlers responsible for retrieving WorkflowTemplate and ClusterWorkflowTemplate objects. The provided patch commit 34afaf9c0c36f1ba8645d483ea4752cfc4a391e8 clearly shows the addition of auth.CanI() permission checks at the beginning of the GetWorkflowTemplate and GetClusterWorkflowTemplate functions. Before this fix, any request, even with a bogus Authorization: Bearer token, could access these templates, leading to the leakage of potentially sensitive data like secrets, as demonstrated in the Proof of Concept. The vulnerable functions are the gRPC handlers themselves, which would be the entry point for an exploit and would appear in any runtime profile or stack trace during a security incident.

Vulnerable functions

Server.GetClusterWorkflowTemplate

server/clusterworkflowtemplate/cluster_workflow_template_server.go

The function `GetClusterWorkflowTemplate` in `server/clusterworkflowtemplate/cluster_workflow_template_server.go` was missing an authorization check. This allowed any user, even those with an invalid token, to retrieve `ClusterWorkflowTemplate` objects, potentially leaking sensitive information contained within them. The patch added a call to `auth.CanI` to verify the user's permissions before processing the request.

Server.GetWorkflowTemplate

server/workflowtemplate/workflow_template_server.go

The function `GetWorkflowTemplate` in `server/workflowtemplate/workflow_template_server.go` was missing an authorization check. This allowed any user, even those with an invalid token, to retrieve `WorkflowTemplate` objects, potentially leaking sensitive information contained within them. The patch added a call to `auth.CanI` to verify the user's permissions before processing the request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.