Bypass of Security Settings in Argo Workflows by Users Submitting Workflows
CVE-2026-31892
What is CVE-2026-31892?
Argo Workflows, a widely used open source container-native workflow engine designed for Kubernetes, is affected by a vulnerability that allows users to bypass security settings defined in a WorkflowTemplate. This occurs when users include a podSpecPatch field during their Workflow submission, allowing the payload to override the administrator-approved template settings, even when templateReferencing is set to Strict. As a result, there is a risk of executing workflows with altered specifications without proper validation, potentially leading to unauthorized actions. This vulnerability has been addressed in versions 4.0.2 and 3.7.11.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
argo-workflows >= 4.0.0, < 4.0.2 < 4.0.0, 4.0.2
argo-workflows >= 2.9.0, < 3.7.11 < 2.9.0, 3.7.11