GHSA-c2hv-4pfj-mm2r Argo Workflow may expose artifact repository credentials

• Go github.com/argoproj/argo-workflows/v3: >= 3.7.0, < 3.7.3 → fixed in 3.7.3 • Go github.com/argoproj/argo-workflows/v3: < 3.6.12 → fixed in 3.6.12

Summary An attacker who has permissions to read logs from pods in a namespace with Argo Workflow can read `workflow-controller` logs and get credentials to the artifact repository. Details An attacker, by reading the logs of the workflow controller pod, can access the artifact repository, and steal, delete or modify the data that resides there. The `workflow-controller` logs show the credentials in plaintext. Impact An attacker with access to pod logs in the `argo` namespace can extract plaintext credentials from the `workflow-controller` logs and gain access to the artifact repository. This can lead to: • Data exfiltration – theft of sensitive or proprietary artifacts • Data tampering – modification of workflows or artifacts • Data destruction – deletion of stored artifacts, leading to potential loss of critical data or pipeline failure