Argo Workflows versions prior to 3.6.17 and 3.7.8 contain a stored XSS vulnerability (CWE-79) in the artifact directory listing feature. This flaw allows any workflow author to inject and execute arbitrary JavaScript in the browsers of other users accessing the Argo Server UI. Exploitation could lead to unauthorized API actions performed with the victim user's privileges. The vulnerability has a CVSS 4.0 base score of 7.3, indicating high severity. Official fixes were released in versions 3.6.17 and 3.7.8. The Red Hat advisory confirms the issue and remediation versions.

Successful exploitation allows an attacker who can author workflows to execute arbitrary JavaScript in other users' browsers within the Argo Server context. This can lead to unauthorized API actions performed with the victim's privileges, potentially compromising workflow management and Kubernetes orchestration tasks. The vulnerability does not appear to have known exploits in the wild at this time.

Upgrade Argo Workflows to version 3.6.17 or later, or 3.7.8 or later, where this stored XSS vulnerability is fixed. No other mitigation or workaround is indicated by the vendor advisory. Patch status is confirmed by the Red Hat advisory.