Argo CD 安全漏洞

Argo CD is an open-source tool developed by Argo for Kubernetes, designed for declarative GitOps continuous delivery. There were security vulnerabilities in versions of Argo CD between 3.2.0 and 3.2.11, as well as between 3.3.0 and 3.3.9. These vulnerabilities stemmed from ServerSideDiff allowing...

PT-2026-36558

Name of the Vulnerable Software and Affected Versions Argo CD versions 3.2.0 through 3.2.10 Argo CD versions 3.3.0 through 3.3.8 Description The 'ServerSideDiff' endpoint allows the disclosure of cleartext Kubernetes Secret data. This occurs when the IncludeMutationWebhook variable is set to true...

CVE-2026-40886

A flaw was found in Argo Workflows, an open-source system for managing tasks in Kubernetes. An attacker with appropriate permissions can trigger a system-wide crash by submitting a specially crafted workflow pod with a malformed annotation. This vulnerability leads to a persistent Denial of Servi...

BIT-ARGO-WORKFLOWS-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the podGCFromPod function when parsing the workflows.argoproj.io/pod-gc-strategy annotation. An attacker can cause the controller process to crash and enter a persistent crash loop by creating a...

GHSA-5JV8-H7QH-RF5P Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

EUVD-2026-25267

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: argo-workflows, saf, jitsucom-jitsu, kubeflow-pipelines, renovate, nextcloud-server, opensearch-dashboards, code-server, sqlpad, langfuse, kubeflow-katib, npm, kubeflow-centraldashboard, py3-jupyterlab, prism...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: migrate, splunk-otel-collector, cloudnative-pg, spire-server, grafana-alloy, kuma, gitlab-kas, rke2-cloud-provider, sftpgo, timescaledb-parallel-copy, amass, spqr, cerbos, flyte, trillian, hydra, kubeflow-pipelines, grafana, seaweedfs, certificate-transparency,...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: dbgate-fips, opensearch-dashboards-fips, sqlpad, kubeflow-pipelines, nextcloud-server, jitsucom-jitsu, kibana, azurite, npm, saf, code-server, nemo, py3-jupyterlab, dbgate, redisinsight, langfuse-fips, kubeflow-centraldashboard, argo-workflows, actions-runner,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: spicedb-fips, openfga-fips, openbao, grafana-alloy, peerdb-flow, gitness, trillian-fips, chainloop-control-plane-fips, gitlab-cng, flyte, juicefs, telegraf, seaweedfs-rocksdb, commercial-expanso-edge, migrate, ferretdb, jitsucom-bulker, step-ca, dapr-fips,...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

The CVE describes an unchecked array index in Argo Workflows’ pod informer, specifically in podGCFromPod(), which can cause a controller-wide panic when a workflow pod has a malformed workflows.argoproj.io/pod-gc-strategy annotation. Affected versions span 3.6.5 through 4.0.4, with the panic occu...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

PT-2026-34719

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 3.6.5 through 3.6.19 Argo Workflows versions 3.7.0-rc1 through 3.7.12 Argo Workflows versions 4.0.0-rc1 through 4.0.4 Description An unchecked array index in the pod informer's podGCFromPod function causes a...

Argo Workflows 输入验证错误漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 3.6.5 to 4.0.4 of Argo Workflows contain a vulnerability related to input validation errors. This vulnerability stems from insufficient array index checking in the podGCFromPod...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: goreleaser, xeol, trivy, nuclei, external-secrets-operator, skaffold, melange, gitsign, terragrunt, osv-scanner, tfsec, grafana-alloy, trivy-operator, gomplate, flux, gitlab-runner, flux-image-automation-controller, gitea, wolfictl, pulumi, argo-cd, syft, cerbos,...