CVE-2025-62157
Medium
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.
SeverityMedium
CVSS6.5
Exploit probability—
ProductArgoproj Argo Workflows
PublishedOct 14, 2025
First seenOct 14, 2025
Weakness typeCWE-522CWE-522
How to fix
Update
- argoproj argo_workflows3.6.12, 3.7.3 or later
- github.com/argoproj/argo-workflows/v33.7.3, 3.6.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| argoproj argo_workflows | v < 3.6.12, 3.7.0 ≤ v < 3.7.3 | 3.6.12, 3.7.3 |
| github.com/argoproj/argo-workflows/v3Go | 3.7.0 ≤ v < 3.7.3, v < 3.6.12 | 3.7.3, 3.6.12 |
| github.com/argoproj/argo-workflowsGo | No range specified | — |
| github.com/argoproj/argo-workflows/v2Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.