CVE-2024-47827

5.7 MEDIUM
Published: October 28, 2024 Modified: February 06, 2026
View on NVD

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75
Source: security-advisories@github.com
Product
https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a
Source: security-advisories@github.com
Patch
https://github.com/argoproj/argo-workflows/pull/13641
Source: security-advisories@github.com
Issue Tracking Patch
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr
Source: security-advisories@github.com
Vendor Advisory

4 reference(s) from NVD

Quick Stats

CVSS v3 Score
5.7 / 10.0
EPSS (Exploit Probability)
0.1%
35th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-362 CWE-1108

Affected Vendors

argoproj

Related CVEs

CVE-2026-4539 3.3
CVE-2026-4538 5.3
CVE-2026-4537 4.7
CVE-2026-4536 7.3
CVE-2026-4535 8.8