Argo Workflows stored all artifact repository credentials in plaintext within workflow executor logs. As a result, any user holding read access to pod logs can retrieve S3 access keys, GCS service account keys, Azure account keys, Git passwords, and similar secrets. This vulnerability allows an attacker with log‑read capabilities to obtain credentials that could compromise external storage services, source code repositories, or other resources tied to the workflow.

The flaw exists in Argo Workflows versions 4.0.0 through 4.0.4, inclusive. Upgrading to version 4.0.5 or later removes the logging of credentials.

The CVSS score of 8.5 indicates a high severity flaw. The EPSS score of 0.00042 indicates a very low exploitation probability, but the vulnerability is still accessible through log reading, which many cluster operators grant to developers or CI users. The flaw is not listed in the CISA KEV catalog, but the nature of the credential leakage poses a significant threat to confidentiality and potentially to the integrity of external services.