Argo Workflows CVE-2026-23960

Exploitation requires the attacker to already be an authenticated Argo workflow author (PR:L) able to create artifacts whose names/paths feed the artifact directory listing, and it requires a victim user to actively open that malicious artifact listing in the Argo Server web UI (UI:A) - it does not fire on its own. It is therefore realistic mainly in multi-tenant or shared Argo Server deployments where a lower-trust author and a higher-privileged viewer coexist; single-tenant clusters where the only authors are trusted operators have little to gain. The high attack complexity (AC:H) reflects the need to craft an artifact entry that survives rendering as executable script. Limiting factors: required prior authentication, required victim interaction, and dependence on the Argo Server UI being exposed to the targeted users.

Signals are consistent and point to a real but moderate, conditional risk rather than an emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H) scores 7.3 (High) but explicitly encodes meaningful friction: high attack complexity (AC:H), low-but-required privileges (PR:L - the attacker must be a legitimate workflow author), and required active user interaction (UI:A - a victim must view the malicious artifact listing). EPSS is very low (0.05%, 16th percentile) and there is no CISA KEV entry, indicating no observed mass exploitation; the 'publicly available' exploit is the GHSA advisory write-up, which raises capability but is not evidence of active exploitation - POC availability and active exploitation are distinct signals. The main escalator is the high technical impact: code running in the Argo Server origin can perform any API action the victim is authorized for, so in multi-tenant Argo clusters a low-privileged author could pivot to a higher-privileged operator's permissions. Net: prioritize patching in shared/multi-tenant Argo deployments, but this is not a drop-everything internet-wide threat.

A low-privileged but legitimate workflow author in a multi-tenant Argo cluster submits a workflow whose artifact produces a crafted name/path containing JavaScript. When a higher-privileged operator later opens the artifact directory listing in the Argo Server UI, the script executes under the server origin and silently issues API calls (e.g., creating or deleting workflows) as that operator. A public advisory (GHSA-cv78-6m8q-ph82) documents the affected code path, lowering the bar to reproduce.