Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

🗓️ 04 May 2026 20:11:38Reported by GitHub Advisory DatabaseType

CVE-2026-31892 fix incomplete; hostNetwork, serviceAccountName, and securityContext bypass via merged workflow spec.

Reporter	Title	Published	Views	Family All 174
ATTACKERKB	CVE-2026-42296	9 May 202603:52	–	attackerkb
ATTACKERKB	CVE-2026-31892	11 Mar 202615:41	–	attackerkb
Chainguard	CVE-2026-31892 vulnerabilities	13 Mar 202601:17	–	cgr
Circl	CVE-2026-31892	11 Mar 202610:08	–	circl
Circl	CVE-2026-42296	9 May 202604:54	–	circl
CNNVD	Argo Workflows 安全漏洞	11 Mar 202600:00	–	cnnvd
CNNVD	Argo Workflows 安全漏洞	9 May 202600:00	–	cnnvd
CVE	CVE-2026-31892	11 Mar 202615:41	–	cve
CVE	CVE-2026-42296	9 May 202603:52	–	cve
Cvelist	CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode	11 Mar 202615:41	–	cvelist

Vulners

Node

Source	Link
github	www.github.com/argoproj/argo-workflows/security/advisories/GHSA-3775-99mw-8rp4
github	www.github.com/argoproj/argo-workflows/security/advisories/GHSA-3wf5-g532-rcrr
github	www.github.com/argoproj/argo-workflows/commit/2727f3f701677d467dfb5e053c57237cbc752c3c
github	www.github.com/argoproj/argo-workflows/releases/tag/v4.0.5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42296
github	www.github.com/argoproj/argo-workflows/commit/534f4ff1cbd86908e8ff76d97d553ad5a49a950d
github	www.github.com/argoproj/argo-workflows/releases/tag/v3.7.14
github	www.github.com/advisories/GHSA-3775-99mw-8rp4

13 May 2026 13:39Current

7.3High risk

Vulners AI Score7.3

CVSS 3.18.1

CVSS 48.9

EPSS0.0038

SSVC