What is the CVSS score of CVE-2026-28229?

CVE-2026-28229 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Kubernetes are affected by CVE-2026-28229?

Argo Workflows versions before 4.0.2 and 3.7.11 expose embedded secrets and credentials through an unauthenticated information disclosure vulnerability with publicly available exploit code,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-28229?

Yes, a public proof-of-concept exploit is available for CVE-2026-28229. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-28229?

Within 24 hours: Inventory all Argo Workflows deployments and confirm current versions in production and non-production environments. Within 7 days: Apply vendor patches by upgrading to Argo Workflows 4.0.2 (or 3.7.11 if on the 3.7.x branch) and verify patches in a staging environment before production deployment. Within 30 days: Audit access logs for unauthenticated template retrieval attempts during the vulnerable period, rotate credentials that may have been embedded in affected workflow templates, and implement network-level access controls restricting Argo API access.

Kubernetes CVE-2026-28229

HIGH

Incorrect Authorization (CWE-863)

2026-03-11 security-advisories@github.com

GHSA-56px-hm34-xqj5

Kubernetes Authentication Bypass Argo Workflows

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network requests with an invalid token reach template endpoints (AV:N/AC:L/PR:N/UI:N); impact is secret disclosure only, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 04:58 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:57 vuln.today

v4 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 04:55 vuln.today

Analysis Updated

Jun 30, 2026 - 04:55 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:55 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:24 NVD

CRITICAL HIGH

CVSS changed

Jun 30, 2026 - 03:24 NVD

9.8 (CRITICAL) 7.5 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 16:16 nvd

CRITICAL 9.8

DescriptionNVD

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is fixed in 4.0.2 and 3.7.11.

AnalysisAI

Information disclosure in Argo Workflows before 4.0.2 and 3.7.11 lets any unauthenticated client read WorkflowTemplates and ClusterWorkflowTemplates by sending a bogus 'Authorization: Bearer nothing' token, leaking embedded Secret manifests and other sensitive template content. The CVSS 3.1 base score is 7.5 (confidentiality-only, network, no privileges) and publicly available exploit code exists, though EPSS is very low (0.04%) and it is not in CISA KEV, indicating no confirmed widespread exploitation yet.