Argo Workflows Vulnerability in Kubernetes Orchestration
CVE-2026-42296
What is CVE-2026-42296?
A vulnerability in Argo Workflows allows users with create Workflow permissions to bypass the Strict mode for template referencing. This enables unauthorized access to the host network, switching of service accounts, overriding pod security contexts, and scheduling on control-plane nodes. Such actions compromise the feature's intended security measures, with the impact being contingent on the existing Kubernetes-level security controls. Clusters utilizing PodSecurity admission or OPA/Gatekeeper would mitigate some consequences, but those relying solely on Argo's Strict mode are entirely exposed. Versions 3.7.14 and 4.0.5 have addressed this issue, ensuring better security for users.
Affected Version(s)
argo-workflows < 3.7.14 < 3.7.14
argo-workflows >= 4.0.0, < 4.0.5 < 4.0.0, 4.0.5