Vulnerability in Argoproj Argo-workflows
CVE-2025-62157
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext i…
EPSS: 0.000 (2.6th percentile) — read the EPSS interpretation.
Affected products
- Argoproj Argo-workflows — versions >= 3.7.0, < 3.7.3, < 3.6.12
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-c2hv-4pfj-mm2r (x_refsource_CONFIRM)
- https://github.com/argoproj/argo-workflows/commit/18ad5138b6bcb2aba04e00b4ec657bc6b8fad8df (x_refsource_MISC)
- https://github.com/argoproj/argo-workflows/commit/bded09fe4abd37cb98d7fc81b4c14a6f5034e9ab (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-62157?
- CVE-2025-62157 is a vulnerability in Argoproj Argo-workflows, classified under Insufficiently Protected Credentials. Published 2025-10-14.
- Is CVE-2025-62157 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.