Aller au contenu
en Se connecter
7.7 Élevée

CVE-2026-40886 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.

Produits et versions touchés

Produit Versions touchées Corrigé en
argo-workflows 4.0 4.0.0 → < 4.0.5 4.0.5
argo-workflows 3.7 3.7.0 → < 3.7.14 3.7.14
argo-workflows 3.6 3.6.5 → 3.6.19 Pas de correctif indiqué
Red Hat OpenShift AI (RHOAI) Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de argo-workflows

Les 17 CVE de argo-workflows →
CVE-2026-93991 Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows… 8.3 Élevée CVE-2026-54526 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.9 Élevée CVE-2026-42296 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.1 Élevée CVE-2026-42295 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes 8.5 Élevée
Suivre cette CVE