Back to overview

CVE-2026-31892

CRITICAL Exploitation: PoC
9.9
CVSS 3.1
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin-approved templates. The podSpecPatch field on a submitted Workflow takes precedence over the referenced WorkflowTemplate during spec merging and is applied directly to the pod spec at creation time with no security validation. This vulnerability is fixed in 4.0.2 and 3.7.11.

Metadata

CVE ID
CVE-2026-31892
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-03-09 21:59 UTC
Published
2026-03-11 15:41 UTC
Last updated
2026-06-30 03:19 UTC
Primary CWE
CWE-863
CWE-863: Incorrect Authorization
Vendor / Product
argoproj / argo-workflows
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
argoproj argo-workflows — >= 4.0.0, < 4.0.2, >= 2.9.0, < 3.7.11
Weakness (CWE)
CWESourceDescription
CWE-863 cna CWE-863: Incorrect Authorization
CWE-807 adp Reliance on Untrusted Inputs in a Security Decision
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
8.9 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
References (1)
Back to overview