29. Workflow Orchestration (K8s-Native)

NuClide Research · 2026-05-27 Pre-assessment OSINT complete. Survey: IN PROGRESS.

K8s-native workflow orchestration platforms expose REST APIs and UI dashboards that carry full pipeline state, resolved parameters (including credentials), artifact access, and in misconfigured deployments, unauthenticated container execution.

Argo Workflows

Auth posture: Tier A* — --auth-mode=server disables all credential requirements. The official quickstart manifest explicitly ships both --auth-mode=server and --auth-mode=client (hybrid), preserving unauthenticated access on the development path. Binary default (v3.0+) is client (safe), but the quickstart path is the dominant exposure vector.

Confirmed population: ~3,000 unauth instances (E.V.A Security, November 2024 internet scan via /api/v1/userinfo probe).

Source: gatekeeper.go explicitly appends empty string to authorizations when no header is present — server mode always matches, regardless of input. The bypass is by design for the server auth mode.

⚠️ Nuclei template argo-workflows-unauth.yaml has incorrect shodan-query: title:"Argo Workflows" in metadata. The correct live-server title is "Argo".

Verification Probe

Single request, definitive — no false-positive risk:

# Unauth detection — server mode confirmed if serviceAccountName is non-empty
curl -sk https://TARGET:2746/api/v1/userinfo | jq .

# Response: server mode (UNAUTH)
{"serviceAccountName":"argo-server","serviceAccountNamespace":"argo","subject":"system:serviceaccount:argo:argo-server","issuer":"kubernetes/serviceaccount"}

# Response: auth enforced
{}

Fingerprint (aimap — not yet implemented as of 2026-05-27)

Port:     2746
Probe:    GET /api/v1/version
Match:    status=200 AND body_contains("gitTag") AND body_contains("gitTreeState") AND body_contains("compiler")
Auth:     GET /api/v1/userinfo → json_field serviceAccountName non-empty
DeepEnum: namespace sweep (argo, kubeflow, ml-pipeline, training, data-science, mlflow)
          CVE-2026-28229 probe (Authorization: Bearer nothing → /api/v1/workflow-templates/{ns})
          version extraction → CVE window classification

High-Value Endpoints (Unauth Instances)

CVE Coverage

Version available from /api/v1/version → map every confirmed host to its CVE exposure window.

Namespace Targets on Confirmed Hosts

Query these namespaces in priority order: argo, kubeflow, ml-pipeline, training, data-science, mlflow, production, staging, minio

kubeflow and ml-pipeline namespaces carry the highest credential density (KFP v1 compiles directly to Argo; training jobs pass S3/GCS keys, MLflow tokens, and dataset paths as workflow parameters).

Shadow Sweep Ports (Every Confirmed Host)

Chain: Argo unauth → etcd open → /registry/secrets/argo/argo-server-token → K8s API authenticated as cluster-scoped SA → cluster-wide control. Etcd co-location upgrades Argo from data-exposure class to cluster-takeover class.

Cert-Pivot Notes (VisorGraph)

Three cert classes in production:

1. CN=localhost self-signed — no pivot value; identifies unmanaged default-config install
2. CN=Kubernetes Ingress Controller Fake Certificate — cluster-level pivot; same cert on all ingress-exposed services; SAN sweep finds Argo CD, Grafana, Prometheus on same cluster
3. Operator-configured domain cert — high-value VisorGraph anchor; CN/SAN reveals org identity, internal DNS, may expose other services on wildcard

VisorGraph anchors: ssl.cert.issuer.cn:"Argo Workflows" (class 1), ingress fake cert fingerprint (class 2), operator domain from CN (class 3).

ML Operator Profile

Dominant user orgs: Intuit (creator/4,000+ engineers), BlackRock, TripAdvisor, Adobe, Cisco, NVIDIA, Tesla (CNCF end-user data). Production use grew 115% YoY (2022). Confirmed hosts are running real ML training pipelines, not sandboxes.

Credential patterns on exposed instances:

• AWS accessKey/secretKey in artifact repository config or hardcoded in workflow parameters
• GCS service account JSON key via serviceAccountKeySecret
• MLflow tracking tokens (MLFLOW_TRACKING_TOKEN env var)
• Database connection strings (feature store, metadata DB)
• Private container registry pull secrets
• Internal service DNS (mlflow.mlflow.svc.cluster.local, postgres.data.svc.cluster.local)

Reference

• E.V.A Security (Nov 2024): https://www.evasec.io/blog/argo-workflows-uncovering-the-hidden-misconfigurations
• Intezer (Jul 2021, in-the-wild exploitation): https://intezer.com/blog/new-attacks-on-kubernetes-via-misconfigured-argo-workflows/
• OSTIF/Ada Logics audit (2022): https://ostif.org/our-audit-of-argo-is-complete-critical-and-high-severity-security-issues-found-and-fixed/
• Argo auth mode docs: https://argo-workflows.readthedocs.io/en/latest/argo-server-auth-mode/
• Practical hardening guide: https://blog.argoproj.io/practical-argo-workflows-hardening-dd8429acc1ce
• Nuclei template: http/misconfiguration/argo-workflows-unauth.yaml
• NuClide pre-assessment brief: case-studies/commercial/argo-workflows-osint-pre-assessment-2026-05-27.md

Temporal (Workflow Orchestration — not yet surveyed)

Port 7233 (gRPC), 8080 (web UI). GET /api/v1/cluster-info. Tier A*. Workflow history exposure. Survey pending.

Kubeflow / KServe (not yet surveyed)

K8s ingress profile — separate from cheap-VPS surface. /v1/models OpenAPI. Exposure dependent on ingress auth config. Survey pending.

Query Log