CVE-2024-53862: Access to Archived Argo Workflows with Fake Token in `client` mode
When using --auth-mode=client
, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/{namespace}/{name}
When using --auth-mode=sso
, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: /api/v1/workflows/{namespace}/{name}
References
Detect and mitigate CVE-2024-53862 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →