CVEvulnerability

CVE-2026-23960

7.3 HIGH Published 2026-01-21 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-01-21
Last modified
2026-07-15
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.3 HIGH — CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

Affected configurations

• argoproj argo workflows (< 3.6.17) • argoproj argo workflows (>= 3.7.0 < 3.7.8)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References