Argoproj Argo-Events vulnerabilities

CVE-2025-32445 [CRITICAL] CWE-250 CVE-2025-32445: Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor CRs allow the corresponding orchestrated pod to be cu

CVE-2022-31054 [HIGH] CWE-400 CVE-2022-31054: Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of serv