Argo Workflows CVE-2025-66626

Exploitation requires the attacker to cause an Argo Workflows executor to extract an attacker-influenced archive via its untar routine - for example by controlling an artifact in a referenced repository (S3/artifact store) or submitting a workflow that pulls the attacker-supplied tar/gz. The archive must contain crafted symbolic links that exploit the flawed link-target computation and validation, enabling an overwrite of /var/run/argo/argoexec, which is then executed at pod start. Limiting factors: only Argo Workflows versions 3.6.13 and below and 3.7.0 through 3.7.4 are affected (fixed in 3.6.14 and 3.7.5); the attack path depends on the artifact-extraction feature processing attacker-controlled data, so it is not a purely default-config drive-by; and environments that applied only the CVE-2025-62156 patch remain vulnerable because that fix is ineffective against malicious symlink archives.

This is a moderate-priority issue rather than an emergency. The NVD CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - network vector, low complexity, no privileges, scoring integrity-only impact. However, the signals are mixed. EPSS is low at 0.68% (51st percentile), indicating no strong evidence of broad opportunistic exploitation, and the vulnerability is NOT on the CISA KEV list, so there is no confirmed active exploitation. Publicly available exploit code exists, which raises near-term likelihood but is a distinct signal from in-the-wild use. No SSVC decision data (exploitation status, automatable, technical impact) was provided, so that framework cannot be applied. Two important caveats: (1) the official vector rates this C:N/I:H/A:N, but the description states the overwritten /var/run/argo/argoexec 'would be executed at the pod's start,' which is arbitrary code execution and realistically implies full confidentiality/integrity/availability impact within the pod - the official score appears to understate the consequence; (2) PR:N implies unauthenticated, yet exploitation requires the attacker to get Argo to extract an attacker-controlled archive, which in most deployments means workflow-submission rights or control of a referenced artifact store - verify realistic privilege prerequisites with the vendor. Note also this is explicitly a bypass of the earlier fix for CVE-2025-62156, so environments that only applied that prior patch remain exposed.

An attacker who can influence an artifact consumed by an Argo Workflow (e.g., planting a malicious tar.gz in a referenced S3/artifact repository, or submitting a workflow that pulls an attacker-controlled archive) crafts an archive containing symbolic links whose target computation and validation the executor mishandles. When the workflow extracts the archive, the flawed untar logic follows the symlink and overwrites /var/run/argo/argoexec with an attacker-supplied script, which then executes automatically when the pod starts, giving the attacker code execution in the pod. Publicly available exploit/PoC code demonstrates the symlink-based archive-extraction bypass.