important · Privilege — Argo
One namespace-scoped Argo account can read archived workflows from every other namespace.
Affects
Argo Workflows, a Kubernetes-native workflow orchestration control plane commonly used for CI, data processing and deployment automation.
The metadata.namespace!= selector passes authorization against the supplied namespace value but becomes a SQL inequality returning other tenants' records.
Detail and 1 source
Those records can expose workflow definitions, parameters, annotations, environment hints, and error traces; patched version ranges are published.
The published fix was not read for this brief, so this cannot lead.