CVE-2026-23960

Katalog CVE

CVSS 5.4 · Medium EPSS 0,40%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada argoproj argo workflows. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

Rincian

Terbit di NVD

21 Januari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82 exploit · advisory vendor
• https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17 patch
• https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/arti... product
• https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17 product · release notes
• https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8 product · release notes
• https://access.redhat.com/security/cve/CVE-2026-23960
• https://bugzilla.redhat.com/show_bug.cgi?id=2431881
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23960.json