CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.

• CWE-863
• CWE-306

• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5Exploit, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/security/cve/CVE-2026-28229
• https://bugzilla.redhat.com/show_bug.cgi?id=2446549
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28229.json

Published

Mar 11, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28223Wagtail is an open source content management system built on…6.1
• CVE-2026-28224Firebird is an open-source relational database management sy…8.2
• CVE-2026-28225Manyfold is an open source, self-hosted web application for …6.5
• CVE-2026-28226Phishing Club is a phishing simulation and man-in-the-middle…6.5
• CVE-2026-28227Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-28228OpenOlat is an open source web-based e-learning platform for…8.8
• CVE-2026-2823A vulnerability was detected in Comfast CF-E7 2.6.0.9. The i…8.8
• CVE-2026-28230SteVe is an open-source EV charging station management syste…6.3
• CVE-2026-28231pillow_heif is a Python library for working with HEIF images…9.1
• CVE-2026-28237Unrestricted resource allocation in AMD uProf may be exploit…5.5
• CVE-2026-2824A flaw has been found in Comfast CF-E7 2.6.0.9. This affects…8.8
• CVE-2026-2825A vulnerability has been found in rachelos WeRSS we-mp-rss u…3.5