Login Request a demo
Medium severity · published Jan 21, 2026
CVE-2026-23960
Argo Workflows affected by stored XSS in the artifact directory listing
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
argo-workflows · argoproj
< 3.6.17; >= 3.7.0, < 3.7.8 · source: vendor
AW
Argo Workflows · Argoproj
before 3.6.17; 3.7.0 before 3.7.8 · source: NVD
RH
Red Hat OpenShift AI (RHOAI) · Red Hat
All versions, or not specified · source: CISA
Affected product
AR
argo-workflows
argoproj
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23960
Product
https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244
Patch
https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17
Product
https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17
Product
https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8
Exploit
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-23960
More from argo-workflows
9.9
CVE-2026-54526
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
8.8
CVE-2025-62156
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
8.3
CVE-2026-42297
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
8.1
CVE-2026-42296
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
8.1
CVE-2026-31892
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode