{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T07:19:18.265","vulnerabilities":[{"cve":{"id":"CVE-2022-29164","sourceIdentifier":"security-advisories@github.com","published":"2022-05-06T00:15:07.990","lastModified":"2026-06-17T04:39:43.300","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions."},{"lang":"es","value":"Argo Workflows es un motor de flujo de trabajo nativo de contenedores de código abierto para orquestar trabajos paralelos en Kubernetes. En las versiones afectadas, un atacante puede crear un flujo de trabajo que produzca un artefacto HTML que contenga un archivo HTML con un script que use llamadas XHR para interactuar con la API del servidor Argo. El atacante envía por correo electrónico el enlace profundo al artefacto a su víctima. La víctima abre el enlace y el script comienza a ejecutarse. Como el script presenta acceso a la API del Servidor Argo (como la víctima), puede leer información sobre los flujos de trabajo de la víctima, o crear y eliminar flujos de trabajo. Tenga en cuenta que el atacante debe ser un insider: debe tener acceso al mismo cluster que la víctima y debe ser capaz de ejecutar sus propios flujos de trabajo. El atacante debe conocer el sistema de la víctima. No hemos visto ninguna evidencia de esto en la naturaleza. Instamos a todos los usuarios a actualizar a las versiones corregidas"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"argoproj","product":"argo-workflows","versions":[{"version":">= 2.6.0, < 3.2.11","status":"affected"},{"version":">= 3.3.0, < 3.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:P/I:P/A:P","baseScore":4.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T15:53:28.321386Z","id":"CVE-2022-29164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*","versionStartIncluding":"2.6.0","versionEndExcluding":"3.2.11","matchCriteriaId":"DE62561D-ED5D-475D-88F1-25DFA88C650C"},{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*","versionStartIncluding":"3.3.0","versionEndExcluding":"3.3.5","matchCriteriaId":"DBAF49A7-99AC-418B-BC01-24D069CB0C83"}]}]}],"references":[{"url":"https://github.com/argoproj/argo-workflows/commit/87470e1c2bf703a9110e97bb755614ce8757fdcc","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/argoproj/argo-workflows/pull/8585","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cmv8-6362-r5w9","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/argoproj/argo-workflows/commit/87470e1c2bf703a9110e97bb755614ce8757fdcc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/argoproj/argo-workflows/pull/8585","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cmv8-6362-r5w9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}