CVE-2025-62157: 
Wolfi vulnerability analysis and mitigation

Argo Workflows, an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes, has been found to expose artifact repository credentials in plaintext in workflow-controller pod logs. This vulnerability (CVE-2025-62157) affects versions prior to 3.6.12 and versions 3.7.0 through 3.7.2. The vulnerability was disclosed on October 14, 2025 (GitHub Advisory).

The vulnerability stems from insufficient protection of credentials (CWE-522) where the workflow-controller logs display artifact repository credentials in plaintext. The vulnerability has received a CVSS v4.0 base score of 8.5 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. This indicates that while the attack requires high privileges, it has potential for significant impact on confidentiality and integrity (GitHub Advisory).

The exposure of artifact repository credentials can lead to several serious consequences. An attacker with access to pod logs in the argo namespace can extract plaintext credentials and potentially perform data exfiltration (theft of sensitive or proprietary artifacts), data tampering (modification of workflows or artifacts), or data destruction (deletion of stored artifacts). This could result in loss of critical data or pipeline failure (GitHub Advisory).

Users should update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist for affected versions (GitHub Advisory).