CVE-2025-66626

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the subsequent check are flawed. An attacker can overwrite the file /var/run/argo/argoexec with a script of their choice, which would be executed at the pod's start. The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. This issue is fixed in versions 3.6.14 and 3.7.5.

• CWE-23
• CWE-78
• CWE-59

• https://github.com/advisories/GHSA-p84v-gxvw-73pfNot Applicable
• https://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037Product
• https://github.com/argoproj/argo-workflows/commit/6b92af23f35aed4d4de8b04adcaf19d68f006de1Patch
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vhExploit, Vendor Advisory
• https://github.com/advisories/GHSA-p84v-gxvw-73pfNot Applicable
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vhExploit, Vendor Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6662PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66620An unused webshell in MicroServer allows unlimited login att…7.2
• CVE-2025-66622matrix-sdk-base is the base component to build a Matrix clie…7.5
• CVE-2025-66623Strimzi provides a way to run an Apache Kafka cluster on Kub…7.4
• CVE-2025-66624BACnet Protocol Stack library provides a BACnet application …7.5
• CVE-2025-66625Umbraco is an ASP.NET CMS. Due to unsafe handling and deleti…4.9
• CVE-2025-66627Wasmi is a WebAssembly interpreter focused on constrained an…7.8
• CVE-2025-66628ImageMagick is a software suite to create, edit, compose, or…7.5
• CVE-2025-66629HedgeDoc is an open source, real-time, collaborative, markdo…4.3
• CVE-2025-6663GStreamer H266 Codec Parsing Stack-based Buffer Overflow Rem…7.8
• CVE-2025-66630Fiber is an Express inspired web framework written in Go. Be…9.4
• CVE-2025-66631CSLA .NET is a framework designed for the development of reu…9.8