CVE-2025-66626High· 8.1▾ TwilightArgo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archive…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the subsequent check are flawed. An attacker can overwrite the file /var/run/argo/argoexec with a script of their choice, which would be executed at the pod's start. The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. This issue is fixed in versions 3.6.14 and 3.7.5.
argo_workflows < 3.6.14argo_workflows >= 3.7.0, < 3.7.5Upgrade past the affected range:
argo_workflows 3.7.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55797High· 8.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2025-62156High· 8.1Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
CVE-2025-62157Medium· 6.5Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
CVE-2026-23960Medium· 5.4Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
CVE-2023-22490Medium· 5.5Git is a revision control system
CVE-2026-10739High· 8.5Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.