Argo Workflows, an open source container-native workflow engine for Kubernetes, versions 4.0.0 to before 4.0.5 improperly log sensitive artifact repository credentials in plaintext during artifact operations. This includes credentials for S3, GCS, Azure, and Git. Because these credentials are exposed in pod logs, any user with read access to the logs can obtain them. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials). A patch addressing this issue was released in version 4.0.5. The CVSS 4.0 score is 8.5 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Exposure of plaintext credentials in workflow pod logs can lead to unauthorized access to artifact repositories and cloud services, potentially compromising sensitive data and workflows. The vulnerability affects all users running vulnerable versions who allow read access to pod logs. There are no known exploits in the wild as of the published date.

Upgrade argo-workflows to version 4.0.5 or later, where this issue is patched. Since this is a cloud service component, the vendor manages remediation for hosted services, but users running self-managed instances must apply the update. Review and rotate any credentials that may have been exposed in logs prior to patching.