Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-11 | 4 | Disclosure4 |
| 2026-03-15 | 2 | Disclosure2 |
CVE-2026-28229 Unauthenticated Information Disclosure in Argo Workflows Before 4.0.2 and 3.7.11 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28229
Post summary
A brief disclosure of CVE-2026-28229, an unauthenticated information disclosure vulnerability affecting Argo Workflows versions before 4.0.2 and 3.7.11, with a link to further details.
🚨*CVE* CVE-2026-28229 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoin… https://www.cve.org/CVERecord?id=CVE-2026-28229 ----- Traducción: CVE-2026-28229 Arg… http://infoflow.cloud`
Post summary
The message links to a CVE record for Argo Workflows, providing minimal context but no proof of exploitation, patch information, or detailed technical data.
CVE-2026-28229 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoin… https://www.cve.org/CVERecord?id=CVE-2026-28229
Post summary
The text provides a brief disclosure of CVE‑2026‑28229 affecting Argo Workflows before versions 4.0.2 and 3.7.11, without any PoC, exploit details, or evidence of active exploitation.
[CVE-2026-28229: CRITICAL] Cybersecurity alert: Argo Workflows versions prior to 4.0.2 and 3.7.11 had a vulnerability leaking sensitive template content. Update to the fixed versions to secure your system.#cve,CVE-2026-28229,#cybersecurity https://cvefind.com/CVE-2026-28229
Post summary
The alert announces CVE‑2026‑28229, noting that Argo Workflows versions before 4.0.2/3.7.11 leak sensitive template content and urges users to update to patched releases.
🔴 CVE-2026-28229 - Critical Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client t... https://www.thehackerwire.com/vulnerability/CVE-2026-28229/ https://t.co/MdfrUrrjrT
Post summary
The post announces a critical vulnerability (CVE-2026-28229) in Argo Workflows affecting versions before 4.0.2 and 3.7.11, with no exploit or mitigation details provided.
🚨 CVE-2026-28229: Argo Workflows has unauthorized ... Bearer token "nothing" bypasses auth entirely - every Argo template with embedded secrets now public via unauthenticate... https://zerodaysignal.com/vulnerability/CVE-2026-28229 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces a new authentication bypass in Argo Workflows (CVE-2026-28229) where the bearer token "nothing" ignores auth, exposing embedded secrets. No exploit code, patch, or evidence of active exploitation is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | argoproj | argo_workflows | - | go | - |