CVE-2021-37914: Argo Workflows Expression Template Evaluation Vulnerability
Summary
CVE-2021-37914: In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression tem... Affects argo-workflows versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Also tracked for
The same CVE-2021-37914 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo Workflows is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. It allows users to define complex workflows using a declarative YAML syntax. Argo Workflows supports the use of expression templates, which enable users to dynamically generate values based on input parameters. However, in versions prior to 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow by exploiting the evaluation of expression template output.
Vulnerability Detail
The vulnerability (CVE-2021-37914) in Argo Workflows arises due to the improper evaluation of expression template output. When untrusted users have the ability to provide input parameters for workflow execution, an attacker can inject malicious expressions that disrupt the workflow. This can lead to various consequences, such as denial of service or unauthorized access to sensitive data. The vulnerability is considered medium severity with a CVSSv3 score of 4.3.
How To Fix
Minimum fixed version
3.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the EXPRESSION_TEMPLATES feature or restrict access to untrusted users. By disabling the feature, the evaluation of expression template output is bypassed, mitigating the vulnerability. However, this may limit the functionality of workflows that rely on expression templates.
Conclusion
The Argo Workflows Expression Template Evaluation Vulnerability (CVE-2021-37914) can be mitigated by upgrading to version 3.1.3 or later. Users should follow the provided upgrade instructions to ensure their installation is secure. If immediate upgrade is not possible, disabling the EXPRESSION_TEMPLATES feature or restricting access to untrusted users can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for argo-workflows →
FAQ
Argo Workflows is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes.
The vulnerability allows an attacker to disrupt workflows by injecting malicious expressions, potentially leading to denial of service or unauthorized access to sensitive data.
The vulnerability is considered medium severity with a CVSSv3 score of 4.3.
To fix this vulnerability, upgrade to Argo Workflows version 3.1.3 or later.
Yes, a temporary workaround is to disable the EXPRESSION_TEMPLATES feature or restrict access to untrusted users.
References
Related vulnerabilities
Recent vulnerabilities recorded for argo-workflows.
