Argo Workflows (Argo Server, TLS keys baked into the container image): MULTI-TENANT ISOLATION: Argo Server's TLS

Impact

MULTI-TENANT ISOLATION: Argo Server's TLS private keys ship inside the published container image, so anyone who can pull the image extracts them. With those keys plus network position an attacker decrypts Argo Server traffic or forges requests to it, which means impersonating the operators and tenants who drive workflow scheduling.

Who can reach it

An attacker on any network path to Argo Server. Affects Argo Server before 3.0 with --secure=true, or 3.0+ where --secure is left unspecified.

What to do

Upgrade to 3.0.9 or 3.1.6 and restart Argo Server. Do not expose Argo Server directly - terminate TLS at a load balancer or ingress holding certificates you issued, and keep the pod reachable only from inside the cluster.

References