Incorrect authorization in Argo Workflows - CVE-2026-31892
Published: April 23, 2026
Argo Workflows
Detailed vulnerability description
The vulnerability allows a remote user to bypass security restrictions and gain root access to the underlying Kubernetes node.
The vulnerability exists due to incorrect authorization in the WorkflowTemplate reference handling and podSpecPatch processing when submitting a Workflow that references an approved WorkflowTemplate with a crafted podSpecPatch. A remote user can submit a Workflow containing a crafted podSpecPatch to bypass security restrictions and gain root access to the underlying Kubernetes node.
The issue occurs even when the controller is configured with templateReferencing set to Strict or Secure, because podSpecPatch takes precedence during spec merging and is applied without security validation.