CVE-2025-62157: Argo Workflows Artifact Repository Credentials Exposure Vulnerability
Summary
CVE-2025-62157: Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- argo-workflows · Bitnami
- github.com/argoproj/argo-workflows/v3 · Go
The same CVE-2025-62157 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo Workflows is an open-source container-native workflow engine for Kubernetes. It allows users to define workflows as Kubernetes resources, enabling the orchestration of complex processes and automation of tasks. The package is widely used for managing CI/CD pipelines and data processing workflows. However, it has been found to potentially expose sensitive artifact repository credentials, which could lead to unauthorized access and data breaches.
Vulnerability Detail
The vulnerability arises from the way Argo Workflows handles artifact repository credentials. If not properly secured, these credentials may be exposed in logs or through misconfigurations, allowing unauthorized users to access sensitive resources. This could lead to significant security risks, including data theft, unauthorized deployments, and compromise of the entire workflow system. The vulnerability affects all versions of the package, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should ensure that sensitive credentials are not logged or exposed in any way. This can be done by configuring logging levels appropriately and using environment variables or secret management tools to handle credentials securely.
Conclusion
The CVE-2025-62157 vulnerability in Argo Workflows poses a significant risk by potentially exposing sensitive artifact repository credentials. Users are urged to update to the latest patched version to mitigate this risk. Additionally, implementing secure credential management practices is essential to protect against unauthorized access.
See every vulnerability recorded for github.com/argoproj/argo-workflows →
FAQ
CVE-2025-62157 is a vulnerability in Argo Workflows that may expose artifact repository credentials, potentially leading to unauthorized access.
All versions of Argo Workflows are affected, but specific fixes are available in versions 3.7.3 and later.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that sensitive credentials are not logged and use secure methods to manage them.
More information can be found on the official Go vulnerability database at https://pkg.go.dev/vuln/GO-2025-4024.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-workflows.
