A path traversal vulnerability in Argo Workflows permits authenticated attackers to achieve arbitrary file writes, potentially leading to container privilege escalation.

This is a Zip Slip path traversal flaw (CWE-22) located in the artifact extraction logic within workflow/executor/executor.go. The vulnerability allows an authenticated user to craft malicious archive entries that bypass directory restrictions, enabling the overwrite of system files such as /etc/passwd or /etc/crontab.

Successful exploitation of this vulnerability allows an attacker to modify critical system configurations within the container environment. This can lead to full privilege escalation, persistent unauthorized access, or the disruption of workflow execution, posing a significant risk to the integrity of the containerized environment. The CVSS score of 8.1 reflects the high impact on integrity and availability.

Immediate Action: Update Argo Workflows to version 3.6.12 or 3.7.3 immediately to incorporate the necessary validation logic for artifact extraction.

Proactive Monitoring: Review container logs for unusual file access patterns or unexpected execution of processes in system directories.

Compensating Controls: Implement strict Kubernetes Network Policies and Pod Security Admissions to limit the impact if a container is compromised, and ensure that workflow containers run with the minimum necessary filesystem permissions.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and persistence, organizations should prioritize patching their Argo Workflows deployments to the specified fixed versions. Verification of the update should be performed immediately to ensure that the artifact extraction path validation is correctly enforced.