CVE-2024-47827

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362 CWE-1108

Affected software

Vendor	Product	Versions
argoproj	argo-workflows	>= 3.6.0-rc1, < 3.6.0-rc2
argoproj	argo-workflows	>= 3.6.0-rc1, < 3.6.0-rc2

References

Timeline

Published: Oct 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-478286.5ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playli CVE-2024-478296.5pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression func CVE-2024-47836.4The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all CVE-2024-478305.8Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.CVE-2024-478317.5Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerab CVE-2024-478329.8ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker CVE-2024-478336.5Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In a CVE-2024-478349.1GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affect CVE-2024-478357.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in t CVE-2024-478364.3Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthentica CVE-2024-47845.4An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowe CVE-2024-478404.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediaw