PT-2026-34719 · Unknown · Argo Workflows
Thevilledev
·
Published
2026-04-23
·
Updated
2026-04-28
·
CVE-2026-40886
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Argo Workflows versions 3.6.5 through 3.6.19
Argo Workflows versions 3.7.0-rc1 through 3.7.12
Argo Workflows versions 4.0.0-rc1 through 4.0.4
Description
An unchecked array index in the pod informer's
podGCFromPod() function causes a controller-wide panic when a workflow pod contains a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it crashes the entire controller process. The poisoned pod persists across restarts, leading to a crash loop that halts all workflow processing until the pod is manually deleted. This allows any user with permission to submit workflows to cause a denial-of-service against all workflows in the cluster.Recommendations
Update Argo Workflows versions 3.6.5 through 3.6.19 to version 3.6.20 or newer.
Update Argo Workflows versions 3.7.0-rc1 through 3.7.12 to version 3.7.14.
Update Argo Workflows versions 4.0.0-rc1 through 4.0.4 to version 4.0.5.
Exploit
Fix
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Argo Workflows