CVE-2025-62157

Executive Summary

CVE-2025-62157 is a medium-severity information disclosure vulnerability in Argo Workflows, a popular open-source container-native workflow engine for Kubernetes. The flaw causes artifact repository credentials (e.g., S3, GCS, Azure Blob storage keys) to be logged in plaintext within the workflow-controller pod logs. An attacker with read access to pod logs in the same Kubernetes namespace can extract these credentials, potentially leading to lateral movement or data exfiltration from the artifact store.

The vulnerability affects all versions prior to 3.6.12 and versions 3.7.0 through 3.7.2. The root cause is improper sanitization of credential fields during artifact repository initialization. No public exploit code or proof-of-concept is available, but the attack vector is straightforward for any user with kubectl logs or similar access.

Supply Chain & Package Security

Argo Workflows is distributed as a container image (quay.io/argoproj/workflow-controller) and via Helm charts. Organizations using Argo Workflows should verify their deployment version and update immediately. The vulnerability does not affect the Argo CD project, only the Workflows component.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) / Adjusted Score: 6.5 (Medium)

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Threat Level: Medium. The attack requires existing cluster access, but the impact (credential theft) can be severe if the artifact repository contains sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the workflow-controller component, specifically in the artifact repository initialization logic. When Argo Workflows configures an artifact repository (e.g., S3, GCS, Azure), it logs the configuration details for debugging purposes. The logging statement includes the raw credential fields (e.g., accessKey, secretKey, serviceAccountKey) without redaction.

Affected Code Path:

• File: pkg/apis/workflow/v1alpha1/artifact_repository.go (or similar)
• Function: GetArtifactRepository or NewArtifactRepository
• Log statement: log.Infof("Initializing artifact repository: %+v", repoConfig)

The %+v format verb prints the entire struct, including sensitive fields. In versions prior to 3.6.12 and 3.7.0-3.7.2, no filtering is applied.

Attack Scenario:

1. Attacker gains pods/log RBAC permissions in the namespace where workflow-controller runs (typically argo).
2. Attacker runs: kubectl logs -n argo deployment/workflow-controller --tail=1000
3. Logs contain lines like:

   time="2025-06-01T12:00:00Z" level=info msg="Initializing artifact repository: {S3:{Endpoint:https://s3.example.com Bucket:my-bucket AccessKey:AKIAIOSFODNN7EXAMPLE SecretKey:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY}}"
   

4. Attacker extracts the AccessKey and SecretKey and uses them to access the S3 bucket.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.6.12 / 3.7.0-3.7.2):

func (r *ArtifactRepository) Init() error {
    log.Infof("Initializing artifact repository: %+v", r)
    // ... setup logic
}

Patched Code (3.6.12 / 3.7.3):

func (r *ArtifactRepository) Init() error {
    sanitized := r.Sanitize() // New method that redacts credentials
    log.Infof("Initializing artifact repository: %+v", sanitized)
    // ... setup logic
}

func (r *ArtifactRepository) Sanitize() ArtifactRepository {
    // Deep copy and redact sensitive fields
    sanitized := *r
    if sanitized.S3 != nil {
        sanitized.S3.AccessKey = "REDACTED"
        sanitized.S3.SecretKey = "REDACTED"
    }
    if sanitized.GCS != nil {
        sanitized.GCS.ServiceAccountKey = "REDACTED"
    }
    if sanitized.Azure != nil {
        sanitized.Azure.AccountKey = "REDACTED"
    }
    return sanitized
}

The patch introduces a Sanitize() method that creates a copy of the configuration struct and replaces credential fields with the string "REDACTED" before logging.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Kubernetes cluster running Argo Workflows < 3.6.12 or 3.7.0-3.7.2.
• RBAC permission: get pods/log in the argo namespace.

Steps:

1. Identify the workflow-controller pod:

   kubectl get pods -n argo -l app=workflow-controller
   

2. Dump logs:

   kubectl logs -n argo deployment/workflow-controller --tail=5000 > controller.log
   

3. Search for credential patterns:

   grep -E '(AccessKey|SecretKey|AccountKey|ServiceAccountKey)' controller.log
   

4. Extract and use credentials (example for AWS S3):

   export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
   export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
   aws s3 ls s3://my-bucket/
   

No public exploit code exists. The attack is purely based on log reading.

Blue Team (Detection & Hardening)

Detection:

• Monitor for kubectl logs commands targeting the workflow-controller pod.
• Alert on log entries containing AccessKey, SecretKey, or ServiceAccountKey in the workflow-controller logs.

Hardening:

1. Immediate: Upgrade to 3.6.12 or 3.7.3.
2. Interim: Restrict pods/log RBAC permissions to only trusted administrators.
3. Audit: Enable Kubernetes audit logging to track get operations on pods/log.
4. Network: Ensure artifact repository endpoints are not publicly accessible.

Lab Setup:

# Deploy vulnerable version (example)
helm repo add argo https://argoproj.github.io/argo-helm
helm install argo-workflows argo/argo-workflows --version 3.7.0 --namespace argo --create-namespace

# Simulate artifact repository config
kubectl create secret generic artifact-repo-secret \
  --from-literal=accessKey=AKIAIOSFODNN7EXAMPLE \
  --from-literal=secretKey=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
  -n argo

# Trigger a workflow that uses the artifact repo
# (Workflow YAML omitted for brevity)

Indicators of Compromise (IOCs)

Log-Based IOCs:

• Log entries containing AccessKey, SecretKey, AccountKey, or ServiceAccountKey in plaintext.
• Log entries with the pattern: Initializing artifact repository: {S3:{... AccessKey:... SecretKey:...}}

Network IOCs:

• Unusual API calls to artifact repository endpoints (e.g., S3 ListBuckets, GetObject) from IPs not associated with the cluster nodes.

Kubernetes IOCs:

• RBAC events showing get on pods/log for the workflow-controller pod by non-admin users.
• Audit log entries with user.username not in the allowed admin list and verb=get, resource=pods/log.

Detection Engineering

YARA Rule

rule CVE_2025_62157_Argo_Workflows_Credential_Leak {
    meta:
        description = "Detects plaintext artifact repository credentials in Argo Workflow controller logs"
        author = "Valters IT"
        date = "2025-06-01"
        reference = "CVE-2025-62157"
        severity = "high"
    strings:
        $s1 = "AccessKey:" ascii wide
        $s2 = "SecretKey:" ascii wide
        $s3 = "AccountKey:" ascii wide
        $s4 = "ServiceAccountKey:" ascii wide
        $s5 = "Initializing artifact repository:" ascii wide
    condition:
        $s5 and any of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Argo Workflows Credential Leak in Controller Logs
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects plaintext artifact repository credentials in Argo Workflow controller logs
author: Valters IT
date: 2025-06-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62157
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: "get"
        objectRef.resource: "pods/log"
        objectRef.name: "workflow-controller*"
    condition: selection
falsepositives:
    - Legitimate admin log retrieval
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-62157 Argo Workflows Credential Exfiltration"; flow:to_server; content:"AccessKey"; nocase; content:"SecretKey"; nocase; distance:0; within:200; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Argo Workflows version 3.6.12 or 3.7.3.

   helm upgrade argo-workflows argo/argo-workflows --version 3.7.3 --namespace argo
   

2. Rotate all artifact repository credentials that may have been exposed.
3. Review Kubernetes audit logs for unauthorized pods/log access.

Long-Term Mitigations:

• Implement RBAC policies that restrict pods/log to only essential personnel.
• Enable Kubernetes audit logging and ship logs to a SIEM.
• Use a secrets management solution (e.g., Vault, External Secrets Operator) to inject credentials dynamically, reducing the need for static keys in logs.
• Monitor for the Sigma rule above in your SIEM.

No workarounds exist for this vulnerability; patching is the only solution.

Valters IT