CVE-2025-66626: 
Wolfi vulnerability analysis and mitigation

CVE-2025-66626 is a symlink-based ZipSlip vulnerability in Argo Workflows, an open-source container-native workflow engine for Kubernetes. The flaw exists in the untar() function's handling of symbolic links within archives, allowing an attacker to overwrite arbitrary files — most critically /var/run/argo/argoexec — with a malicious script that executes at pod startup, enabling remote code execution. Affected versions include all releases up to and including 3.6.13 and versions 3.7.0 through 3.7.4. This vulnerability is a bypass of the patch for CVE-2025-62156, which addressed a related ZipSlip issue. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the GitHub advisory rates it 8.1 (High) due to additional availability impact (GitHub Advisory).

The root cause lies in flawed symlink target computation within workflow/executor/executor.go (lines 1034–1037). The vulnerable code computes a symlink's target using filepath.Join(filepath.Dir(target), header.Linkname) and then checks whether the result is within the destination directory. However, this check fails to account for absolute symlink targets — if header.Linkname is an absolute path (e.g., /etc), filepath.Join returns it unchanged, bypassing the prefix check entirely. This is classified as CWE-23 (Relative Path Traversal), CWE-59 (Improper Link Resolution Before File Access), and CWE-78 (OS Command Injection). An attacker crafts a malicious archive containing a symlink pointing to an arbitrary directory (e.g., /etc) and a regular file written through that symlink, then supplies the archive as a workflow artifact input. The patch for CVE-2025-62156 addressed path traversal via .. sequences but did not handle absolute symlink targets, making it ineffective against this attack vector (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to overwrite arbitrary files within the pod's filesystem, including the critical /var/run/argo/argoexec binary, replacing it with a script of their choice that executes at pod startup. This results in remote code execution with pod-level privileges, enabling unauthorized command execution, compromise of Kubernetes workflow integrity, and potential lateral movement within the cluster. The primary impact is high integrity loss; confidentiality and availability impacts vary by attacker objective but can include persistent access and disruption of CI/CD or ML pipelines running on Argo Workflows (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly documented in the GitHub security advisory, demonstrating the attack using a crafted archive with a symlink pointing to /etc and a file written through it. No evidence of active in-the-wild exploitation has been reported as of the advisory date. The EPSS score is approximately 0.065%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires network access and low privileges (ability to submit workflow artifacts), making it accessible to authenticated users of a vulnerable Argo Workflows deployment (GitHub Advisory, Feedly).

1. Craft a malicious archive: Create a .tar.gz file containing two entries: (a) a symbolic link (e.g., ./work/foo) with an absolute target pointing to a sensitive directory (e.g., /var/run/argo), and (b) a regular file at a path that traverses through the symlink (e.g., ./work/foo/argoexec) containing a malicious shell script.
2. Host the archive: Upload the malicious archive to an accessible location (e.g., an S3 bucket, HTTP server, or artifact repository) that the target Argo Workflows instance can retrieve.
3. Submit a workflow: Deploy an Argo Workflow YAML that specifies the malicious archive as an input artifact with the extraction path set to /work/tmp (or another path accessible to the wait container).
4. Trigger extraction: When the workflow executes, the argoexec wait container downloads and extracts the archive using the vulnerable untar() function. The absolute symlink target bypasses the path prefix check, causing the symlink to be created pointing outside the extraction directory.
5. Achieve file overwrite: The regular file entry is written through the symlink, overwriting /var/run/argo/argoexec with the attacker's script.
6. Execute malicious code: At the next pod startup, the replaced argoexec binary (now the attacker's script) is executed, achieving remote code execution with pod-level privileges (GitHub Advisory).

• File System: Unexpected modification timestamp or content change on /var/run/argo/argoexec; presence of shell scripts or unexpected executables in /var/run/argo/; symlinks in artifact extraction directories (e.g., /work/tmp) pointing to paths outside the extraction root.
• Logs: Argo Workflows executor logs showing artifact extraction from untrusted or external sources immediately before pod failures or unexpected behavior; errors or anomalies in argoexec startup logs.
• Process: Unexpected processes spawned by argoexec at pod initialization (e.g., reverse shells, curl, wget, bash with unusual arguments); child processes of the init/wait container executing scripts not part of the workflow definition.
• Network: Outbound connections from workflow pods to unexpected external IPs or domains shortly after pod startup, potentially indicating reverse shell or data exfiltration activity.

Upgrade Argo Workflows to version 3.6.14 or 3.7.5, which contain the fix that correctly validates both relative and absolute symlink targets before extraction (GitHub Advisory, Patch Commit). Organizations that previously applied the CVE-2025-62156 patch should be aware that it does not protect against this variant and must upgrade to the newly patched versions. As interim mitigations, implement strict access controls on who can submit workflows and supply artifact inputs, validate and sanitize all archive inputs before processing, and use network segmentation to limit the blast radius of a compromised pod.

Endor Labs published a technical blog post titled "When a Broken Fix Leads to RCE: How We Found CVE-2025-66626 in Argo" detailing the discovery and the bypass of the CVE-2025-62156 patch, highlighting the research process behind identifying the incomplete fix (Endor Labs Blog). The vulnerability was credited to researchers cristianstaicu and meenakshisl in the GitHub advisory. The issue was also picked up by SUSE and distributed Linux security channels, with advisories published for affected package ecosystems including Wolfi and Chainguard.