Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-32445
CVE-2025-32445:
Chainguard vulnerability analysis and mitigation
Overview
A critical security vulnerability (CVE-2025-32445) was discovered in Argo Events, an event-driven workflow automation framework for Kubernetes. The vulnerability allows users with permission to create/modify EventSource and Sensor custom resources to gain privileged access to the host system and cluster, even without having direct administrative privileges. The vulnerability was discovered in April 2025 and has been fixed in version v1.9.6 (GitHub Advisory).
Technical details
The vulnerability stems from how EventSource and Sensor custom resources (CRs) can be customized with spec.template and spec.template.container specifications. These CRs allow users to specify various container properties including command, args, securityContext, and volumeMount, which are then applied to the EventSource or Sensor pod. The vulnerability has received a CVSS v3.1 base score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (NVD).
Impact
The vulnerability's impact is particularly severe in multi-tenant Kubernetes clusters. Successful exploitation can lead to broken tenant isolation, unauthorized host/cluster access by non-admin users, access to other tenants' data, and bypassing of security models including RBAC restrictions and Pod Security Policies/Standards. The vulnerability ultimately allows for host system compromise (Security Online).
Mitigation and workarounds
The Argo team has released version v1.9.6 which patches this vulnerability by limiting the allowed properties under spec.template.container. Users of Argo Events are strongly advised to upgrade to this version immediately to mitigate the risk (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management