CVE-2026-40886

A flaw was found in Argo Workflows, an open-source system for managing tasks in Kubernetes. An attacker with appropriate permissions can trigger a system-wide crash by submitting a specially crafted workflow pod with a malformed annotation. This vulnerability leads to a persistent Denial of Servi...

BIT-ARGO-WORKFLOWS-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the podGCFromPod function when parsing the workflows.argoproj.io/pod-gc-strategy annotation. An attacker can cause the controller process to crash and enter a persistent crash loop by creating a...

GHSA-5JV8-H7QH-RF5P Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

EUVD-2026-25267

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: argo-workflows, opensearch-dashboards, npm, renovate, sqlpad, py3-jupyterlab, jitsucom-jitsu, prism, saf, nextcloud-server, kubeflow-katib, kubeflow-pipelines, kubeflow-centraldashboard, langfuse, code-server...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: wal-g, step, gitness, trillian, keda, bento, grafana, kuma, sftpgo-plugin-eventsearch, flyte, gitlab-kas, juicefs, migrate, timescaledb-parallel-copy, k3s, caddy, cerbos, temporal-server, openbao, spire-server, sftpgo, envoy-gateway, hydra,...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, py3-jupyterlab, wazuh-dashboard, saf, code-server, nemo, prism, jitsucom-jitsu, homepage, gitlab-rails-ce-fips, actions-runner, wazuh-dashboard-fips, redisinsight, dbgate-fips, sqlpad, drupal, nextcloud-server, arangodb, langfuse-fips, langfuse,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: sqlexporter-fips, ferretdb, seaweedfs-rocksdb-fips, temporal, envoy-gateway-fips, rke2-cloud-provider, sftpgo-plugin-eventsearch, opentelemetry-collector-contrib-fips, grafana-fips, ory-kratos, gitaly-fips, ldap2pg, harbor, splunk-otel-collector-fips, gotrue,...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

The CVE describes an unchecked array index in Argo Workflows’ pod informer, specifically in podGCFromPod(), which can cause a controller-wide panic when a workflow pod has a malformed workflows.argoproj.io/pod-gc-strategy annotation. Affected versions span 3.6.5 through 4.0.4, with the panic occu...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

PT-2026-34719

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 3.6.5 through 3.6.19 Argo Workflows versions 3.7.0-rc1 through 3.7.12 Argo Workflows versions 4.0.0-rc1 through 4.0.4 Description An unchecked array index in the pod informer's podGCFromPod function causes a...

Argo Workflows 输入验证错误漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 3.6.5 to 4.0.4 of Argo Workflows contain a vulnerability related to input validation errors. This vulnerability stems from insufficient array index checking in the podGCFromPod...

GHSA-R4Q5-VMMM-2653 vulnerabilities

Vulnerabilities for packages: argo-workflows, opensearch-dashboards, configurable-http-proxy, prism, saf, nextcloud-server, kubeflow-katib, lerna, kubeflow-pipelines, thingsboard, langfuse, code-server...

GHSA-R5FR-RJXR-66JC vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, py3-jupyterlab, wazuh-dashboard, saf, code-server, prism, pelias-api, jitsucom-jitsu, gitlab-rails-ce-fips, wazuh-dashboard-fips, redisinsight, semaphore, json-server, vitess, sqlpad, drupal, arangodb, langfuse-fips, langfuse, argo-workflows,...

CVE-2026-2950 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, py3-jupyterlab, wazuh-dashboard, saf, code-server, prism, pelias-api, jitsucom-jitsu, gitlab-rails-ce-fips, wazuh-dashboard-fips, redisinsight, semaphore, json-server, vitess, sqlpad, drupal, arangodb, langfuse-fips, langfuse, argo-workflows,...