Log in Start free

Vulnerability · Published Jan 21, 2026 · Assigned by GitHub_M

CVE-2026-23960Argo Workflows affected by stored XSS in the artifact directory listing

High 7.1

In plain English

A high-severity cross-site scripting in argo-workflows from argoproj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 64.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/argoproj/argo-workflowsno fix listedGHSA-cv78-6m8q-ph82
Gogithub.com/argoproj/argo-workflowsno fix listedGO-2026-4350
Gogithub.com/argoproj/argo-workflows/v2no fix listedGO-2026-4350
Gogithub.com/argoproj/argo-workflows/v33.6.17GHSA-cv78-6m8q-ph82
Gogithub.com/argoproj/argo-workflows/v33.7.8GHSA-cv78-6m8q-ph82
Gogithub.com/argoproj/argo-workflows/v33.6.17, 3.7.8GO-2026-4350

Affected products (as reported)

VendorProductVersions
argoproj argo-workflows < 3.6.17>= 3.7.0, < 3.7.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References