Incorrect authorization in Argo Workflows - #VU126909

Detailed vulnerability description

The vulnerability allows a remote user to bypass workflow template restrictions and modify pod security-sensitive settings.

The vulnerability exists due to incorrect authorization in WorkflowSpec merging and enforcement logic when submitting a workflow that references a hardened template under templateReferencing Strict or Secure mode. A remote user can submit a crafted workflow with overridden fields such as hostNetwork, serviceAccountName, or securityContext to bypass workflow template restrictions and modify pod security-sensitive settings.

The bypass applies when user-supplied WorkflowSpec fields survive JoinWorkflowSpec and are applied during pod creation, including in Secure mode where the merged spec is stored on first submission.

Remediation

Sources

• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-3775-99mw-8rp4
• https://github.com/advisories/GHSA-3775-99mw-8rp4