| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/argoproj/argo-workflows | 全バージョン | |
| github.com/argoproj/argo-workflows/v2 | 全バージョン | |
| github.com/argoproj/argo-workflows/v3 | 全バージョン | |
| github.com/argoproj/argo-workflows/v4 | ≥ 4.0.0, < 4.0.5 | 4.0.5 |
| argo workflows | ≥ 4.0.0, < 4.0.5 | 4.0.5 |
The workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials.
Note: This is an incomplete fix of CVE-2025-62157
The logging driver passes the entire ArtifactDriver struct to the structured logger, for example: https://github.com/argoproj/argo-workflows/blob/59f1089b9875723ddffd524513e6bd5cb37e5e31/workflow/artifacts/logging/driver.go#L24
Exposed credential fields:
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
name: cred-leak-test
namespace: argo
spec:
entrypoint: main
templates:
- name: main
container:
image: alpine:3.13
command: [sh, -c]
args: ["echo 'hello' > /tmp/output.txt"]
outputs:
artifacts:
- name: output
path: /tmp/output.txt
s3:
endpoint: minio:9000
insecure: true
bucket: my-bucket
key: test-output.txt
accessKeySecret:
name: my-minio-cred
key: accesskey
secretKeySecret:
name: my-minio-cred
key: secretkey
kubectl -n argo logs "cred-leak-test" -c wait
<img width="1248" height="322" alt="image" src="https://github.com/user-attachments/assets/a5cf6d66-7d67-408d-8583-27d11ecf1507" />
Any user with Kubernetes RBAC permissions to read pod logs in the workflow namespace can extract artifact repository credentials.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン