Argo Workflows, a container-native workflow engine for Kubernetes, had an incorrect authorization vulnerability (CWE-863) in its WorkflowTemplates endpoints before versions 4.0.2 and 3.7.11. Any client sending a request with an Authorization header containing a bearer token with no value ('Bearer nothing') could access WorkflowTemplates and ClusterWorkflowTemplates, potentially exposing sensitive data such as embedded Secret manifests. This vulnerability is addressed by fixes in versions 4.0.2 and 3.7.11. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability allows unauthenticated attackers to access sensitive workflow template data, including embedded secrets, which could lead to unauthorized disclosure of confidential information and compromise of the workflow environment. The vulnerability affects confidentiality, integrity, and availability with a critical severity rating.

A fix is available and users should upgrade to argoproj argo-workflows version 4.0.2 or 3.7.11 or later. The vendor advisory from Red Hat confirms these versions contain the official fix. No additional mitigation steps are indicated beyond applying the official patch.