argo-events vulnerabilities

2 known vulnerabilities in argo-events from Argoproj. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  argo-events: Execution with Unnecessary Privileges

  CVE-2025-32445Apr 15, 2025Argoproj

  Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative pr

• 7.5 High severity

  argo-events: Out-of-bounds Write

  CVE-2022-31054Jun 13, 2022ArgoprojEPSS 1.63%

  Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who send