Forgery of Argo Server TLS Requests
Summary
GHSA-6c73-2v8x-qpvm: Argo Server TLS requests could be forged by attacker with network access. Affects github.com/argoproj/argo-workflows/v3 across 2 version ranges.
>= 3.0.0, < 3.0.9
>= 3.1.0, < 3.1.6
Fixed in 3.0.9 or 3.1.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo Server is an open-source workflow engine that enables users to define, run, and manage complex workflows in Kubernetes. It provides a declarative way to define workflows using YAML files and supports various features such as parallelism, retries, and event-driven triggers. Argo Server can be run in secure mode by enabling TLS encryption for requests. However, prior to version 3.0 or when running version 3.0 with --secure unspecified, there is a vulnerability that allows an attacker with network access to forge TLS requests.
Vulnerability Detail
The vulnerability in Argo Server allows an attacker within the network to exploit the packaged keys within the image. By extracting these keys, the attacker can decrypt traffic or forge requests. This could lead to unauthorized access, data manipulation, or interception of sensitive information. It is important to note that no known exploits of this vulnerability have been reported, but it is recommended to apply the fix as a proactive measure.
How To Fix
Latest published version: v3.7.18 as of 22 Oct 2026
go get github.com/argoproj/argo-workflows/v3@v3.7.18Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.0.93.0.9go get github.com/argoproj/argo-workflows/v3@v3.0.9 -
>= 3.1.0, < 3.1.63.1.6go get github.com/argoproj/argo-workflows/v3@v3.1.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Argo Server is not immediately feasible, a workaround is to ensure that the Argo Server service or pod is not directly accessible outside of the cluster. Instead, a TLS load balancer should be placed in front of Argo Server to handle external requests and enforce secure communication.
Conclusion
The vulnerability in Argo Server that allows for the forgery of TLS requests can be mitigated by updating to the recommended versions or applying the provided workaround. It is important to stay proactive in addressing security vulnerabilities to protect sensitive data and ensure the integrity of workflows. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-workflows/v3 →
FAQ
Argo Server is an open-source workflow engine for Kubernetes that allows users to define, run, and manage complex workflows using YAML files.
The vulnerability allows an attacker within the network to forge TLS requests and potentially gain unauthorized access, manipulate data, or intercept sensitive information.
No known exploits of this vulnerability have been reported. However, it is recommended to apply the fix as a proactive measure.
To fix this vulnerability, update Argo Server to version 3.0.9 or later if running a version prior to 3.0, or version 3.1.6 or later if running version 3.1.
Yes, a workaround is to ensure that the Argo Server service or pod is not directly accessible outside of the cluster and to use a TLS load balancer for external requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-workflows/v3.
