CVE-2022-29164: Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows
Summary
CVE-2022-29164: Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows. Affects github.com/argoproj/argo-workflows/v3 across 2 version ranges.
>= 2.6.0, < 3.2.11
>= 3.3.0, < 3.3.5
Fixed in 3.2.11 or 3.3.5, depending on the release line you run. How to fix ↓
Also tracked for
- argo-workflows · Bitnami
The same CVE-2022-29164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo Workflows is an open source container-native workflow engine designed for orchestrating parallel jobs on Kubernetes. It provides a platform for managing and executing workflows in a Kubernetes cluster. The vulnerability identified as CVE-2022-29164 affects versions 2.6.0 to 3.2.11 and 3.3.0 to 3.3.5 of the github.com/argoproj/argo-workflows/v3 package in the Go ecosystem.
Vulnerability Detail
The vulnerability allows an attacker with insider access to the same cluster as the victim to exploit a privilege escalation issue. By creating a workflow that produces a malicious HTML artifact containing a script that uses XHR calls to interact with the Argo Server API, the attacker can send the artifact's deep-link to the victim. When the victim opens the link, the script starts running with the victim's privileges, enabling the attacker to perform actions such as reading information about the victim's workflows, creating or deleting workflows, and potentially leaving an audit trail. While the impact of this vulnerability is high, it is difficult to exploit due to the social engineering aspect and the need for the attacker to have an understanding of the victim's system.
How To Fix
Latest published version: v3.7.18 as of 22 Oct 2026
go get github.com/argoproj/argo-workflows/v3@v3.7.18Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 3.2.113.2.11go get github.com/argoproj/argo-workflows/v3@v3.2.11 -
>= 3.3.0, < 3.3.53.3.5go get github.com/argoproj/argo-workflows/v3@v3.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to disable the Argo Server. However, this workaround may limit the functionality of workflow management. It is recommended to upgrade to the fixed versions of the package to fully address the vulnerability.
Conclusion
The vulnerability identified as CVE-2022-29164 in the github.com/argoproj/argo-workflows/v3 package of Argo Workflows allows for privilege escalation through a malicious HTML+XHR artifact. While the impact is high, exploiting this vulnerability is challenging due to the need for insider access and an understanding of the victim's system. Users are strongly advised to upgrade to the fixed versions of the package or consider disabling the Argo Server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-workflows/v3 →
FAQ
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. It provides a platform for managing and executing workflows in a Kubernetes cluster.
The vulnerability allows an attacker with insider access to the same cluster as the victim to exploit a privilege escalation issue. The attacker can perform actions such as reading information about the victim's workflows, creating or deleting workflows, and potentially leaving an audit trail.
Users of Argo Workflows versions 2.6.0 to 3.2.11 and 3.3.0 to 3.3.5 are affected by this vulnerability.
No evidence of this vulnerability being exploited has been found in the wild.
Users should upgrade to the fixed versions of the github.com/argoproj/argo-workflows/v3 package. Disabling the Argo Server is also suggested as a workaround, although it may impact workflow management functionality.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-workflows/v3.
