Read the docs
TI-2026-29542 Aliases CVE-2026-40886GHSA-5jv8-h7qh-rf5p

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Priority HIGH 67CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-129 and the CVSS impact.

Summary

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed argo-workflows (argoproj): 4.0.5, 3.7.14github.com/argoproj/argo-workflows/v4 (Go): 4.0.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-workflows4.0.0 to before 4.0.5; 3.7.0 to before 3.7.14; 3.6.5 – 3.6.194.0.5, 3.7.14Patch availableCNA
—github.com/argoproj/argo-workflows/v4 (Go)4.0.0 to before 4.0.54.0.5Patch availableGHSA-5jv8-h7qh-rf5p
—github.com/argoproj/argo-workflows/v3 (Go)3.7.0 to before 3.7.143.7.14Patch availableGHSA-5jv8-h7qh-rf5p
—github.com/argoproj/argo-workflows/v3 (Go)3.6.5 – 3.6.19—No fix listedGHSA-5jv8-h7qh-rf5p
  • argo-workflows Vendorargoproj Affected 4.0.0 to before 4.0.5; 3.7.0 to before 3.7.14; 3.6.5 – 3.6.19 Fixed in 4.0.5, 3.7.14 Patch available CNA
  • github.com/argoproj/argo-workflows/v4 (Go) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-5jv8-h7qh-rf5p
  • github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected 3.7.0 to before 3.7.14 Fixed in 3.7.14 Patch available GHSA-5jv8-h7qh-rf5p
  • github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected 3.6.5 – 3.6.19 Fixed in — No fix listed GHSA-5jv8-h7qh-rf5p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*3.6.5 – 3.6.19; 3.7.0 to before 3.7.14; 4.0.0 to before 4.0.5Vulnerableargoproj
  • cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* Versions 3.6.5 – 3.6.19; 3.7.0 to before 3.7.14; 4.0.0 to before 4.0.5 Vulnerable ·argoproj

Remediation

  • Fix · CNA argo-workflows (argoproj) Fixed in 4.0.5, 3.7.14
  • Fix · GHSA-5jv8-h7qh-rf5p github.com/argoproj/argo-workflows/v4 (Go) Fixed in 4.0.5 Advisory →
  • Fix · GHSA-5jv8-h7qh-rf5p github.com/argoproj/argo-workflows/v3 (Go) Fixed in 3.7.14 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40886
  2. 2026-10-03 Alias added: GHSA-5jv8-h7qh-rf5p

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-22564 Argo Workflows has unauthorized access to Argo Workflows Template CVSS 3.1CRITICAL 9.8
  • TI-2026-30603 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVSS 4.0HIGH 8.2
  • TI-2026-39371 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing CVSS 4.0HIGH 8.9
  • TI-2026-24444 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode CVSS 4.0HIGH 8.9
  • TI-2026-30604 Argo Workflows: Exposure of artifact repository credentials CVSS 4.0HIGH 8.5
  • TI-2025-38478 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences