CVE-2026-23960: github.com/argoproj/argo-workflows fixed in 2.5.3-rc4

CVE-2026-23960 PUBLISHED CVSS 5.400000095367432 MEDIUM

Argo Workflows affected by stored XSS in the artifact directory listing

Record from NVD · Published January 21, 2026

github.com/argoproj/argo-workflows is fixed in 2.5.3-rc4 (Go Modules)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

EPSS 0.41% · 35.9th percentile

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/argoproj/argo-workflows	Go Modules	2.5.3-rc4
argo_workflows	argoproj	3.7.8, 3.6.17

Risk scores

CVSS 3.1

5.400000095367432

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

0.41%

35.9th percentile

Affected products

Vendor	Product	Versions
argoproj	argo_workflows	3.7.0, 0

Timeline

Jan 21, 2026 CVE Published
Jan 22, 2026 EPSS Score (30 in total, the first dated here)
Jan 22, 2026 PoC Published (6 in total, the first dated here)
Jan 29, 2026 Security Advisory
Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Jul 15, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-23960
vulnetix vdb fixes CVE-2026-23960

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-23960/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →