Skip to content
fr Sign in
7.7 High

CVE-2026-40886 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.

Affected products and versions

Product Affected versions Fixed in
argo-workflows 4.0 4.0.0 → < 4.0.5 4.0.5
argo-workflows 3.7 3.7.0 → < 3.7.14 3.7.14
argo-workflows 3.6 3.6.5 → 3.6.19 No fix stated
Red Hat OpenShift AI (RHOAI) Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of argo-workflows

The 17 CVEs of argo-workflows →
CVE-2026-93991 Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows… 8.3 High CVE-2026-54526 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.9 High CVE-2026-42296 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.1 High CVE-2026-42295 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.5 High
Track this CVE