CVE-2026-42295

Katalog CVE

CVSS 4.9 · Medium EPSS 0,40%

Kerentanan Insufficiently Protected Credentials pada argoproj argo workflows. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.

Rincian

Terbit di NVD

9 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf exploit · advisory vendor
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 release notes