CVE-2021-37914: Workflow re-write vulnerability in github.com/argoproj/argo-workflows/v3
Summary
CVE-2021-37914: Workflow re-write vulnerability using input parameter. Affects github.com/argoproj/argo-workflows/v3 versions >= 3.1.0, < 3.1.6. Fixed in 3.1.6. How to fix ↓
Also tracked for
- github.com/argoproj/argo-workflows · Go
- argo-workflows · Bitnami
The same CVE-2021-37914 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/argoproj/argo-workflows/v3 is a Go package that provides workflow automation and orchestration capabilities. It allows end-users to define and execute complex workflows. However, a vulnerability has been discovered in the package that allows malicious actors to exploit input parameters and potentially compromise the security of the workflows.
Vulnerability Detail
The vulnerability in github.com/argoproj/argo-workflows/v3 allows end-users to set input parameters, which can be manipulated by attackers to execute arbitrary code or perform unauthorized actions within the workflows. This can lead to various security risks, including data breaches, privilege escalation, and unauthorized access to sensitive information. The vulnerability has a moderate severity rating and is identified as CWE-20.
How To Fix
Latest published version: v3.7.18 as of 22 Oct 2026
go get github.com/argoproj/argo-workflows/v3@v3.7.18Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.6
This is the first release that contains the fix.
go get github.com/argoproj/argo-workflows/v3@v3.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the EXPRESSION_TEMPLATES environment variable to false for the workflow controller. This will disable the vulnerable functionality and mitigate the risk of exploitation. However, this workaround may impact the functionality of certain workflows, so it should be used with caution.
Conclusion
In conclusion, the package github.com/argoproj/argo-workflows/v3 is vulnerable to a workflow re-write vulnerability that allows attackers to manipulate input parameters. It is important to update the package to the latest version once a patch is released and regularly check for updates to ensure the security of workflows. As a temporary workaround, the EXPRESSION_TEMPLATES environment variable can be set to false, but this may impact workflow functionality. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-workflows/v3 →
FAQ
The vulnerability allows attackers to manipulate input parameters and potentially execute arbitrary code or perform unauthorized actions within workflows, leading to security risks such as data breaches and unauthorized access.
To fix the vulnerability, update the package to version 3.1.6 or later once a patch is released. Regularly check for updates and apply them promptly.
Yes, you can set the EXPRESSION_TEMPLATES environment variable to false for the workflow controller as a temporary workaround. However, this may impact the functionality of certain workflows.
The vulnerability has a moderate severity rating.
Yes, you can refer to the GitHub advisory for more details and updates on the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-workflows/v3.
