Artifact Repository Credentials Exposure in Argo Workflows by Argo Project
CVE-2025-62157
8.5HIGH
What is CVE-2025-62157?
Argo Workflows, a leading open source workflow engine for container orchestration on Kubernetes, has a vulnerability that exposes artifact repository credentials in plaintext within the pod logs of the workflow-controller. This issue affects users of versions prior to 3.6.12 and versions 3.7.0 through 3.7.2. Attackers with access to the pod logs can compromise these credentials, potentially leading to unauthorized access to sensitive artifact repositories. To address this vulnerability, upgrading to Argo Workflows version 3.6.12 or later, specifically 3.7.3, is essential. Unfortunately, there are currently no workarounds available.
Affected Version(s)
argo-workflows >= 3.7.0, < 3.7.3 < 3.7.0, 3.7.3
argo-workflows < 3.6.12 < 3.6.12