CVE-2026-23960
Medium
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.
SeverityMedium
CVSS5.4
Exploit probability—
ProductArgoproj Argo Workflows
PublishedJan 21, 2026
First seenJan 21, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- argoproj argo_workflows3.6.17, 3.7.8 or later
- github.com/argoproj/argo-workflows/v33.6.17, 3.7.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| argoproj argo_workflows | v < 3.6.17, 3.7.0 ≤ v < 3.7.8 | 3.6.17, 3.7.8 |
| github.com/argoproj/argo-workflows/v3Go | v < 3.6.17, 3.7.0 ≤ v < 3.7.8 | 3.6.17, 3.7.8 |
| github.com/argoproj/argo-workflowsGo | v ≤ 2.5.3-rc4, No range specified | — |
| github.com/argoproj/argo-workflows/v2Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.