CVE-2025-66626

Executive Summary

CVE-2025-66626 is a critical path traversal and arbitrary file overwrite vulnerability in Argo Workflows, a popular Kubernetes-native workflow engine. The flaw resides in the unsafe handling of symbolic links during archive extraction (untar). An attacker can craft a malicious archive containing a symbolic link that, when extracted, overwrites the /var/run/argo/argoexec binary with attacker-controlled content. This binary is executed at pod startup, leading to remote code execution (RCE) in the context of the Argo workflow pod. The vulnerability affects versions 3.6.13 and below, and 3.7.0 through 3.7.4. The previous patch for CVE-2025-62156 was insufficient. No public exploit code or PoC is currently available, but the risk is high due to the potential for full cluster compromise.

Supply Chain & Package Security

Argo Workflows is distributed as a container image and Go binary. The vulnerability is in the core untar logic, which is part of the argoexec binary. Users who pull the official images from Docker Hub or Quay.io are affected. There is no indication of compromise in the official supply chain, but users should verify image digests and signatures.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be triggered by submitting a malicious workflow archive.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – An unauthenticated attacker can submit a workflow.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerable component is the Argo Workflow pod.
• Confidentiality Impact: None (C:N) – No direct data disclosure.
• Integrity Impact: High (I:H) – Arbitrary file overwrite.
• Availability Impact: High (A:H) – Overwriting the binary can cause denial of service or arbitrary code execution.

Threat Level: High. The vulnerability allows an attacker to achieve RCE in the Argo Workflow pod, potentially leading to lateral movement within the Kubernetes cluster.

Deep Dive & Mechanics

The vulnerability is in the archive extraction logic used by Argo Workflows to handle workflow artifacts. When a workflow is submitted, Argo may extract archives (e.g., tar.gz) containing input artifacts. The extraction code attempts to prevent path traversal by checking if the resolved path of a file is within the extraction directory. However, the check for symbolic links is flawed.

Flawed Logic:

1. The code reads the symbolic link target from the archive.
2. It computes the absolute path of the link target by joining the extraction directory with the link target.
3. It then checks if this computed path starts with the extraction directory.
4. The flaw: If the symbolic link target is an absolute path (e.g., /var/run/argo/argoexec), the join operation may produce a path that is not properly validated. Specifically, the check may pass if the absolute path is not correctly resolved relative to the extraction directory.

Exploitation Scenario:

1. An attacker submits a workflow with a malicious archive.
2. The archive contains a symbolic link entry: symlink -> /var/run/argo/argoexec.
3. The extraction code incorrectly validates this link, allowing it to be created.
4. When the pod starts, the argoexec binary is executed, running the attacker's script.

The previous patch (CVE-2025-62156) attempted to fix this by adding additional checks, but it did not handle the case where the symbolic link target is an absolute path that points outside the extraction directory.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func extractArchive(archivePath, destDir string) error {
    // ...
    for _, entry := range archive.Entries {
        if entry.Type == tar.TypeSymlink {
            linkTarget := entry.Linkname
            // Flawed: does not properly handle absolute paths
            resolvedPath := filepath.Join(destDir, linkTarget)
            if !strings.HasPrefix(resolvedPath, destDir) {
                return fmt.Errorf("path traversal detected")
            }
            // Create symlink
            os.Symlink(linkTarget, filepath.Join(destDir, entry.Name))
        }
    }
}

Patched Code (simplified):

func extractArchive(archivePath, destDir string) error {
    // ...
    for _, entry := range archive.Entries {
        if entry.Type == tar.TypeSymlink {
            linkTarget := entry.Linkname
            // Correctly resolve the link target relative to the extraction directory
            resolvedPath := filepath.Join(destDir, entry.Name)
            resolvedLink := filepath.Join(filepath.Dir(resolvedPath), linkTarget)
            // Clean the path to resolve any ".." or absolute components
            cleanedLink := filepath.Clean(resolvedLink)
            if !strings.HasPrefix(cleanedLink, filepath.Clean(destDir)+string(filepath.Separator)) {
                return fmt.Errorf("path traversal detected")
            }
            // Create symlink
            os.Symlink(linkTarget, filepath.Join(destDir, entry.Name))
        }
    }
}

The patched code uses filepath.Clean to resolve the absolute path of the link target and then checks if it starts with the extraction directory. This prevents absolute path symlinks from escaping.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an Argo Workflows instance (e.g., via API or UI).
• Ability to submit a workflow with a custom artifact.

Steps:

1. Create a malicious archive containing a symbolic link to /var/run/argo/argoexec.
2. The archive should also contain a script that will be written to the target path.
3. Submit the workflow with the malicious archive as an input artifact.
4. When the pod starts, the argoexec binary is overwritten and executed.

Example Malicious Archive Creation:

# Create a script to execute
echo '#!/bin/sh
echo "PWNED" > /tmp/pwned
' > payload.sh

# Create a tar archive with a symlink
tar -cf malicious.tar --transform='s|payload.sh|/var/run/argo/argoexec|' payload.sh
# Note: The above is simplified; actual exploitation requires crafting the tar entry manually.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Response)

Detection:

• Monitor for workflow submissions containing archives with symbolic links.
• Alert on any file writes to /var/run/argo/argoexec outside of normal pod initialization.
• Use runtime security tools (e.g., Falco) to detect unexpected file modifications.

Response:

• Immediately isolate affected pods.
• Review workflow submission logs for suspicious archives.
• Upgrade to patched versions (3.6.14 or 3.7.5).
• If upgrade is not possible, implement a webhook to validate archives before extraction.

Indicators of Compromise (IOCs)

• File: /var/run/argo/argoexec modified or replaced.
• Process: Unexpected processes spawned from /var/run/argo/argoexec.
• Network: Outbound connections from Argo workflow pods to unknown IPs.
• Logs: Workflow submission logs containing archives with symbolic links to absolute paths.
• Artifact: Tar archives with entries having Linkname set to absolute paths (e.g., /var/run/argo/argoexec).

Detection Engineering

YARA Rule

rule CVE_2025_66626_Argo_Symlink_Overwrite {
    meta:
        description = "Detects malicious archives targeting Argo Workflows CVE-2025-66626"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66626"
    strings:
        $symlink = { 00 00 00 00 00 00 00 00 } // Placeholder for symlink type
        $target = "/var/run/argo/argoexec" nocase
    condition:
        $symlink and $target
}

Sigma Rule

title: CVE-2025-66626 Argo Workflows Symlink Overwrite
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects workflow submissions with archives containing symbolic links to /var/run/argo/argoexec
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: argo_workflows
detection:
    selection:
        event: workflow_submitted
        artifact_type: archive
        symlink_target: "/var/run/argo/argoexec"
    condition: selection
falsepositives:
    - Legitimate use of symlinks (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66626 Argo Workflows Symlink Overwrite"; flow:to_server; content:"/var/run/argo/argoexec"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Argo Workflows to version 3.6.14 or 3.7.5.
• If upgrade is not possible, restrict workflow submission to trusted users only.

Mitigation:

• Implement a mutating webhook that validates archives before extraction.
• Use Kubernetes Pod Security Standards to restrict container capabilities.
• Monitor file integrity of /var/run/argo/argoexec using tools like AIDE or Tripwire.

Long-term:

• Review and harden all archive extraction code.
• Conduct regular security audits of open-source dependencies.

Valters IT
Securing DevOps, One CVE at a Time.