Read the docs
TI-2026-39371 Aliases CVE-2026-54526GHSA-48p8-g2fx-3wwm

Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Priority HIGH 74CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection, and WorkflowSpec.ArtifactGC is allow-listed wholesale; the struct behind that field, WorkflowLevelArtifactGC, has a PodSpecPatch sub-field whose contents flow unmodified into util.ApplyPodSpecPatch on the artifact-GC pod, the same sink the original fix closed for WorkflowSpec.PodSpecPatch, so a user submitting a Workflow under templateReferencing: Strict or Secure (against a referenced WorkflowTemplate that declares an output artifact and setting spec.artifactGC.strategy: OnWorkflowCompletion) can still inject an arbitrary strategic merge patch into the artifact-GC pod, including hostPath volumes, privileged: true, arbitrary image and command, and hostNetwork: true, defeating the stated purpose of Strict/Secure reference mode. This issue is fixed in versions 3.7.15 and 4.0.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed argo-workflows (argoproj): 3.7.15, 4.0.6github.com/argoproj/argo-workflows/v4 (Go): 4.0.6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-workflowsbefore 3.7.15; 4.0.0 to before 4.0.63.7.15, 4.0.6Patch availableCNA
—github.com/argoproj/argo-workflows/v4 (Go)4.0.0 to before 4.0.64.0.6Patch availableGHSA-48p8-g2fx-3wwm
—github.com/argoproj/argo-workflows/v3 (Go)before 3.7.153.7.15Patch availableGHSA-48p8-g2fx-3wwm
—github.com/argoproj/argo-workflows (Go)up to 2.5.3-rc4—No fix listedGHSA-48p8-g2fx-3wwm
  • argo-workflows Vendorargoproj Affected before 3.7.15; 4.0.0 to before 4.0.6 Fixed in 3.7.15, 4.0.6 Patch available CNA
  • github.com/argoproj/argo-workflows/v4 (Go) Vendor— Affected 4.0.0 to before 4.0.6 Fixed in 4.0.6 Patch available GHSA-48p8-g2fx-3wwm
  • github.com/argoproj/argo-workflows/v3 (Go) Vendor— Affected before 3.7.15 Fixed in 3.7.15 Patch available GHSA-48p8-g2fx-3wwm
  • github.com/argoproj/argo-workflows (Go) Vendor— Affected up to 2.5.3-rc4 Fixed in — No fix listed GHSA-48p8-g2fx-3wwm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*before 3.7.15; 4.0.0 to before 4.0.6Vulnerableargoproj
  • cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* Versions before 3.7.15; 4.0.0 to before 4.0.6 Vulnerable ·argoproj

Remediation

  • Fix · CNA argo-workflows (argoproj) Fixed in 3.7.15, 4.0.6
  • Fix · GHSA-48p8-g2fx-3wwm github.com/argoproj/argo-workflows/v4 (Go) Fixed in 4.0.6 Advisory →
  • Fix · GHSA-48p8-g2fx-3wwm github.com/argoproj/argo-workflows/v3 (Go) Fixed in 3.7.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54526
  2. 2026-10-03 Alias added: GHSA-48p8-g2fx-3wwm

References

Exploit 1

Patch 2

Advisory 1

Other 3

  • TI-2026-22564 Argo Workflows has unauthorized access to Argo Workflows Template CVSS 3.1CRITICAL 9.8
  • TI-2026-30603 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVSS 4.0HIGH 8.2
  • TI-2026-24444 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode CVSS 4.0HIGH 8.9
  • TI-2026-30604 Argo Workflows: Exposure of artifact repository credentials CVSS 4.0HIGH 8.5
  • TI-2025-38478 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite CVSS 3.1HIGH 8.8
  • TI-2026-30606 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider CVSS 4.0HIGH 8.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences