CVE-2026-23960

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.6.17 and prior to 3.7.8

Description Argo Workflows contains a stored cross-site scripting (XSS) issue in the artifact directory listing. This allows a workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, potentially enabling API actions with the victim’s privileges. The issue stems from the directory listing response in server/artifacts/artifact server.go rendering object names directly into HTML without proper escaping. Object names are attacker-controlled when a workflow writes files into an output artifact directory. The vulnerable code is located at fmt.Fprintf within the specified file. An attacker can create a malicious workflow that produces a crafted HTML artifact containing a script. By sending a deep-link to this artifact to a victim, the attacker can execute the script in the victim's browser, potentially allowing the attacker to perform actions on the Argo Server API with the victim’s permissions, such as reading workflow information or creating/deleting workflows.

Recommendations Argo Workflows versions prior to 3.6.17 should be updated to version 3.6.17 or later. Argo Workflows versions prior to 3.7.8 should be updated to version 3.7.8 or later.