Incorrect authorization in Argo Workflows - CVE-2026-42296
Published: April 23, 2026
Vulnerability details
The vulnerability allows a remote user to bypass workflow template restrictions and modify pod security-sensitive settings.
The vulnerability exists due to incorrect authorization in WorkflowSpec merging and enforcement logic when submitting a workflow that references a hardened template under templateReferencing Strict or Secure mode. A remote user can submit a crafted workflow with overridden fields such as hostNetwork, serviceAccountName, or securityContext to bypass workflow template restrictions and modify pod security-sensitive settings.
The bypass applies when user-supplied WorkflowSpec fields survive JoinWorkflowSpec and are applied during pod creation, including in Secure mode where the merged spec is stored on first submission.