XSS in Argoproj Argo-workflows
CVE-2026-23960
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitra…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (26.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Argoproj Argo-workflows — versions < 3.6.17, >= 3.7.0, < 3.7.8
- Argoproj Argo_workflows
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-23960?
- CVE-2026-23960 is a medium-severity vulnerability in Argoproj Argo-workflows, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-01-21.
- How severe is CVE-2026-23960?
- Medium severity. CVSS v3 base score is 5.4 out of 10.