Argo Workflows — Pre-Assessment OSINT Brief (2026-05-27)

NuClide Research · 2026-05-27 Status: OSINT complete. Survey chain: pending. 6-agent parallel research. Sources: primary docs, source code, CVE databases, published prior research.

---

What This Is

Intelligence gathered before the population scan to fine-tune dork selection, fingerprint design, verification methodology, and scope. Not a survey — a survey prep document. The scan chain runs after this.

DCWF KSAT coverage

Auto-derived from DCWF AI work-role rule files (ksat-tag).

• 672 (AI Test & Evaluation Specialist): K7003, K7004, K7044, S7068, S7070, S7075, T5858, T5904, T5919
• 733 (AI Risk & Ethics Specialist): S7067, T5868, T5893, T5904
• overlap (Common AI KSATs (all 5 roles)): K108, K1158, K1159, K22, K6311, K6900, K6935, K7003, K7024, K942

---

The Target

Argo Workflows — Kubernetes-native workflow engine by argoproj. Used at population scale in ML/MLOps pipelines (Kubeflow v1 compiles to Argo; Hera, Couler, and direct YAML users on top). Created and maintained by Intuit; adopted by BlackRock, Adobe, Cisco, NVIDIA, Tesla, TripAdvisor (CNCF end-user data). Production use grew 115% YoY as of 2022.

This is not a dev-sandbox tool. Confirmed hosts are running real production ML training pipelines.

---

Auth Posture

Tier A* — auth optional, off by design in the server mode path.

Auth Modes

Four modes; one disables all credential requirements:

What Ships Where

The quickstart manifest has shipped hybrid mode since v3.0 and still does on the current main branch. Operators who followed the quickstart and exposed port 2746 without an ingress auth layer are the primary population.

---

Fingerprint

Port

2746 — Argo-exclusive. Default HTTPS (self-signed). HTTP requires explicit --secure=false.

Alternate exposure: :80/:443 via reverse proxy, :8080 in dev setups.

HTML at Root (/)

Page title: "Argo" — NOT "Argo Workflows". The existing nuclei template’s shodan-query: title:"Argo Workflows" is wrong and hits docs sites.

Distinctive body signals:

• assets/favicon/favicon-32x32.png — exact favicon path in HTML source (non-standard; not served at /favicon.ico)
• meta name="robots" content="noindex"
• <div id="app"></div> (SPA mount point)

No distinctive Server: header — gRPC-gateway does not advertise itself.

API Responses

GET /api/v1/version (effectively public, minimal auth check):

{
  "version": "v3.5.2",
  "buildDate": "...",
  "gitCommit": "...",
  "gitTag": "v3.5.2",
  "gitTreeState": "clean",
  "goVersion": "go1.21.5",
  "compiler": "gc",
  "platform": "linux/amd64"
}

Distinctive field combo: gitTag + gitTreeState + compiler + platform.

TLS Cert (Default Self-Signed)

Issuer CN: "Argo Workflows" — confirmed Shodan-indexable. Alternate: CN=localhost (older versions).

Shodan Dorks (Ranked)

Run all 5 variants; populations overlap but do not fully coincide (proxied instances not on 2746, cert dork catches different TLS profiles).

---

Verification Primitive

Single request. Definitive. No false-positive risk.

curl -sk https://TARGET:2746/api/v1/userinfo

Unauth confirmed: response contains serviceAccountName (non-empty)

{"serviceAccountName":"argo-server","serviceAccountNamespace":"argo"}

Auth enforced: {} or HTTP 401/403

This is the same probe E.V.A Security used to find ~3,000 unauth instances in November 2024.

---

Population Estimate

E.V.A scan is ~6 months old. Population has likely grown.

---

Attack Surface on Unauth Instances

argo-server ClusterRole Permissions (Inherited by All Callers in Server Mode)

configmaps:    get, watch, list, create, update
secrets:       get, create
pods:          get, list, watch, delete
pods/exec:     (included)
pods/log:      (included)
serviceaccounts: get, list, watch
argoproj.io/*: create, get, list, watch, update, patch, delete (all workflow resources)

Every unauthenticated caller executes with these permissions against the cluster.

High-Value Endpoints

Namespace Targets (Query in This Order)

argo → kubeflow → ml-pipeline → training → data-science → mlflow → production → staging → minio

kubeflow and ml-pipeline namespaces carry the highest credential density — KFP v1 compiles to Argo and passes S3/GCS keys, MLflow tokens, and dataset paths as workflow parameters.

Credential Patterns on Exposed Instances

• AWS accessKey/secretKey — in artifact repository config or hardcoded in workflow parameters (most common misuse)
• GCS service account JSON key — via serviceAccountKeySecret in artifact specs
• MLflow tracking tokens — MLFLOW_TRACKING_TOKEN env var, common in training pipelines
• Database connection strings — feature store, metadata DB, passed as parameters
• Container registry pull secrets — imagePullSecrets in pod spec
• Internal service DNS — mlflow.mlflow.svc.cluster.local, postgres.data.svc.cluster.local in parameter values
• Private ECR/GCR image paths — in template container image fields

The status.nodes section of a completed workflow contains resolved output values from each step — data extracted from files, API call responses, intermediate results. This is often richer than spec.arguments.parameters.

---

CVE Landscape

Version extraction from /api/v1/version maps each confirmed host to its CVE exposure window. Run this on every confirmed host.

Research Gaps We Can Fill

• No nuclei template for CVE-2026-28229 (Bearer nothing template exfil)
• No nuclei template for CVE-2024-53862 (archived workflow fake-token bypass)
• The E.V.A Nov 2024 scan (~3,000 hosts) has not been followed up with full-stack chain verification in any published research
• GHSA-xchc-cqwg-g76q (Sync ConfigMap CRUD zero-auth) appears under-researched

---

Argo Ecosystem Co-Deployment

Port Map

Shadow Sweep Priorities

WorkflowExec → SA token → K8s API chain: Submit workflow → exec into pod → read /var/run/secrets/kubernetes.io/serviceaccount/token → use against K8s API server (6443) authenticated as Argo SA → if SA has pods/exec cluster-wide → execute into any pod in the cluster.

Cert-Pivot (VisorGraph)

Three cert classes in production:

1. CN=localhost / CN=Argo Workflows self-signed — identifies default-config install. ssl.cert.issuer.cn:"Argo Workflows" is the Shodan dork.
2. CN=Kubernetes Ingress Controller Fake Certificate — cluster-level pivot. Same cert on all ingress-exposed services. SAN sweep finds Argo CD, Grafana, Prometheus on same cluster.
3. Operator-configured domain cert — high-value VisorGraph anchor. CN/SAN reveals org identity, internal DNS, may expose wildcard covering other services (*.ops.corp.com).

---

aimap Fingerprint (Build Before Survey)

No existing Argo Workflows fingerprint in aimap as of 2026-05-27. Port 2746 is in port_classes.go workflow-orch class but no matching entry in fingerprints.go.

Required fingerprint spec:

Fingerprint{
    Name: "Argo Workflows",
    DefaultPorts: []int{2746},
    Probes: []Probe{
        {
            Path: "/api/v1/version",
            MatchCond: []Condition{
                {Type: CondStatus, Value: "200"},
                {Type: CondBodyContains, Value: "gitTag"},
                {Type: CondBodyContains, Value: "gitTreeState"},
                {Type: CondBodyContains, Value: "compiler"},
            },
        },
    },
}

// Auth classifier (deep enum)
// GET /api/v1/userinfo → json_field serviceAccountName non-empty → UNAUTH

// Deep enum steps:
// 1. Extract version string from /api/v1/version → classify CVE exposure
// 2. List workflows across target namespaces: argo, kubeflow, ml-pipeline, training, data-science, mlflow
// 3. CVE-2026-28229 probe: GET /api/v1/workflow-templates/{ns} with Authorization: Bearer nothing
// 4. Extract spec.arguments.parameters from workflow list → credential pattern detection
// 5. Enumerate /api/v1/cron-workflows → reveals pipeline schedules + data cadence
// 6. Shadow sweep: 2379, 9090, 9100, 6379, 9000, 10250

---

Prior Research

Nuclei template exists: http/misconfiguration/argo-workflows-unauth.yaml — probes /api/v1/workflows/argo, matches metadata + items in body. Shodan-query metadata in the template is incorrect (title:"Argo Workflows" — hits docs sites). No template for CVE-2026-28229 or CVE-2024-53862.

No CISA KEV entries for Argo Workflows as of 2026-05-27.

---

Session Notes

• 6-agent parallel OSINT run: auth modes, Shodan fingerprint, API surface, CVEs, ML deployment patterns, ecosystem co-deployment
• All 6 agents completed; findings synthesized above
• Next: build aimap fingerprint → JAXEN harvest (all 5 dork variants) → full chain

---

References

• E.V.A Security (Nov 2024): https://www.evasec.io/blog/argo-workflows-uncovering-the-hidden-misconfigurations
• Intezer (Jul 2021): https://intezer.com/blog/new-attacks-on-kubernetes-via-misconfigured-argo-workflows/
• OSTIF audit (2022): https://ostif.org/our-audit-of-argo-is-complete-critical-and-high-severity-security-issues-found-and-fixed/
• Argo auth mode docs: https://argo-workflows.readthedocs.io/en/latest/argo-server-auth-mode/
• Practical hardening: https://blog.argoproj.io/practical-argo-workflows-hardening-dd8429acc1ce
• GHSA-56px-hm34-xqj5 (CVE-2026-28229): https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5
• CVE-2025-66626 (Endor Labs): https://www.endorlabs.com/learn/when-a-broken-fix-leads-to-rce-how-we-found-cve-2025-66626-in-argo
• gatekeeper.go source: https://github.com/argoproj/argo-workflows/blob/main/server/auth/gatekeeper.go
• argo-server-clusterole.yaml: https://github.com/argoproj/argo-workflows/blob/main/manifests/cluster-install-no-crds/argo-server-rbac/argo-server-clusterole.yaml