BIT-argo-workflows-2025-62157

    Dashboard / Vulnerabilities / BIT-argo-workflows-2025-62157

    BIT-argo-workflows-2025-62157

    Published: 17 Oct 2025Last Modified: 8 Sept 2026

    Summary: Argo Workflows exposes artifact repository credentials in workflow-controller logs

    Details: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.

    References: https://github.com/argoproj/argo-workflows/commit/18ad5138b6bcb2aba04e00b4ec657bc6b8fad8df, https://github.com/argoproj/argo-workflows/commit/bded09fe4abd37cb98d7fc81b4c14a6f5034e9ab, https://github.com/argoproj/argo-workflows/security/advisories/GHSA-c2hv-4pfj-mm2r, https://nvd.nist.gov/vuln/detail/CVE-2025-62157

    Affected packages

    Package

    Name: argo-workflows

    Purl: pkg:bitnami/argo-workflows

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.6.12

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-argo-workflows-2025-62157 | CVE-DB