Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Argo Workflows FIPS may let attackers tamper with Git data

published 8 months ago
Summary

The Go-based git library used in the argo-workflows-fips package has several weaknesses that could allow an attacker to modify or view repository contents. This puts your workflow code and deployment scripts at risk of unauthorized changes. Apply the latest security updates from the vendor as soon as they are available.

What to do
  • Update cleanstart argo-workflows-fips to version 3.7.3-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart argo-workflows-fips < 3.7.3-r0
Fix: upgrade to 3.7.3-r0
Original advisory text
go-git is a highly extensible git implementation library written in pure Go
Multiple security vulnerabilities affect the argo-workflows-fips package. go-git is a highly extensible git implementation library written in pure Go. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published25 Feb 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-DV04077 · OSV
Track software like this
Free during beta