Homepage

Improper Certificate Validation Affecting argo-workflows-ui-fips-3.6 package, versions <3.6.17-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.17% (7th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-ARGOWORKFLOWSUIFIPS36-22107331
  • published1 Nov 2026
  • disclosed29 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 29 Oct 2026

NewCVE-2026-118780  (opens in a new tab)
CWE-295  (opens in a new tab)
CWE-471  (opens in a new tab)

How to fix?

Upgrade Minimos:latest argo-workflows-ui-fips-3.6 to version 3.6.17-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream argo-workflows-ui-fips-3.6 package and not the argo-workflows-ui-fips-3.6 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.