CVE-2026-28229

API endpoints handling workflow templates (WorkflowTemplates and ClusterWorkflowTemplates) incorrectly verify authorization of incoming requests. An attacker can send an HTTP request with the 'Authorization: Bearer nothing' header — essentially any false token — and receive the full content of templates in response. These templates may contain embedded Kubernetes Secret manifests, leading to the leakage of sensitive authentication and configuration data. The error is classified as improper authorization (CWE-863), meaning the system does not correctly check whether the requesting entity has the right to access the resource.

An attacker without any permissions can read all workflow templates, including sensitive data embedded in them (e.g., passwords, tokens, API keys contained in Secret manifests). This can lead to compromise of the entire Kubernetes environment managed by Argo Workflows.

Argo Workflows should be updated to version 4.0.2 or 3.7.11, in which the vulnerability has been fixed. Additionally, it is recommended to review workflow templates for the presence of embedded sensitive data and move them to dedicated secret management mechanisms.

Argo Workflows in versions earlier than 4.0.2 and earlier than 3.7.11