A critical path traversal vulnerability in Argo Workflows permits authenticated attackers to overwrite sensitive system files and execute arbitrary commands, leading to potential system compromise.

This vulnerability involves unsafe handling of symbolic links within archives during the untar process. An authenticated attacker can exploit this flaw to overwrite the critical file /var/run/argo/argoexec with a malicious script, which is subsequently executed upon pod startup.

The exploitation of this flaw allows an attacker to achieve OS command injection, which can lead to full container compromise, lateral movement within the Kubernetes cluster, and potential exfiltration of sensitive data. With a CVSS score of 8.1, this represents a high-severity risk that could result in significant operational disruption and loss of integrity for the affected workflow orchestration environment.

Immediate Action: Upgrade to Argo Workflows version 3.6.14 or 3.7.5 immediately to incorporate the necessary security patches for the untar function.

Proactive Monitoring: Monitor container logs and Kubernetes audit logs for unusual file modification patterns or unauthorized process execution originating from the argoexec binary.

Compensating Controls: Implement strict Kubernetes Network Policies to limit pod communication and ensure that container images are scanned for malicious artifacts prior to deployment.

Public Exploit Available: No

Given the potential for remote code execution within the containerized environment, organizations should prioritize patching to the versions identified above. Security teams must treat this vulnerability with high urgency and verify that all workflow executors are running the updated, hardened code to prevent unauthorized command execution.