Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

argoproj/argo-workflows

              main @ 2e0513f
            

Fixes

CVEs

CRITICAL

Peak severity

45.9%

Coverage

Highlights

Denial of Service: 35 prior fixes. Scrutinize any change in this area.

workflow/controller/operator.go: most-fixed (10 issues). Treat as high-risk during review.

37 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The workflow executor previously invoked the external 'jq' shell utility, exposing the system to shell injection via un-sanitized input. This was replaced with an in-process Go parser ('gojq').

Auth Bypass: Flaws in token and cookie parsing, missing fallback mode rejection, and improper service account mapping rules allowed API operations to bypass configured authentication modes.

Privilege Escalation: User overrides or strategic merges in workflow templates could modify highly sensitive security fields (e.g. ServiceAccountName, PodSpecPatch, and PodMetadata) inside the GC Pod spec.