CVE-2026-23960

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23960

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

A

rgo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.

References
Link Resource
https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244 Product
https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17 Patch
https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17 Product Release Notes
https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8 Product Release Notes
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*
cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*
History

17 Feb 2026, 16:56

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CPE cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*
First Time Argoproj argo Workflows
Argoproj
References () https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244 - () https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244 - Product
References () https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17 - () https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e17 - Patch
References () https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17 - () https://github.com/argoproj/argo-workflows/releases/tag/v3.6.17 - Product, Release Notes
References () https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8 - () https://github.com/argoproj/argo-workflows/releases/tag/v3.7.8 - Product, Release Notes
References () https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82 - () https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82 - Exploit, Vendor Advisory

21 Jan 2026, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-21 22:15

Updated : 2026-02-17 16:56

NVD link : CVE-2026-23960

Mitre link : CVE-2026-23960

CVE.ORG link : CVE-2026-23960

JSON object : View

Products Affected

argoproj

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')