Medium severity · published May 9, 2026
CVE-2026-42295
Argo Workflows: Exposure of artifact repository credentials
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
argo-workflows · argoproj
>= 4.0.0, < 4.0.5 · source: vendor
AW
Argo Workflows · Argoproj
4.0.0 before 4.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42295
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42295
Release Notes
https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5
Exploit
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf
More from argo-workflows
9.9
CVE-2026-54526
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
8.8
CVE-2025-62156
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
8.3
CVE-2026-42297
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
8.1
CVE-2026-42296
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
8.1
CVE-2026-31892
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode