{"id":"GHSA-rc7p-gmvh-xfx2","aliases":[],"url":"https://o3.security/vulnerability/GHSA-rc7p-gmvh-xfx2","summary":"Attack on Kubernetes via Misconfigured Argo Workflows","details":"### Impact\n\nUsers running using the Argo Server with `--auth-mode=server` (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.\n\n### Resolution\n\n* Do not expose your user interface to the Internet. \n* Change configuration. `--auth-mode=client`. \n\nFor users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.\n","published":"2021-08-02T17:19:52Z","modified":"2021-08-02T17:18:32Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-rc7p-gmvh-xfx2"},{"type":"WEB","url":"https://www.intezer.com/blog/container-security/new-attacks-on-kubernetes-via-misconfigured-argo-workflows"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-08-02T17:18:32Z"}}