Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the podGCFromPod function when parsing the workflows.argoproj.io/pod-gc-strategy annotation. An attacker can cause the controller process to crash and enter a persistent crash loop by creating a...

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

GHSA-5JV8-H7QH-RF5P Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

EUVD-2026-25267

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: code-server, saf, kubeflow-katib, langfuse, kubeflow-pipelines, argo-workflows, opensearch-dashboards, prism, renovate, kubeflow-centraldashboard, sqlpad, nextcloud-server, jitsucom-jitsu, py3-jupyterlab, npm...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: trillian, bento, hydra, spire-server, azure-service-operator, cerbos, migrate, k3s, gitlab-kas, caddy, openbao, opentelemetry-collector-contrib, telegraf, falcosidekick, kine, envoy-gateway, temporal, grafana, pgtimetable, kube-bench, jitsucom-bulker, kots,...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: gemini-cli, arangodb, jitsucom-jitsu, drupal, kubeflow-centraldashboard, langfuse, azurite, langfuse-fips, gitlab-rails-ce-fips, sqlpad, kibana, py3-captum, dbgate-fips, dbgate, gitlab-rails-ce, kubeflow-katib, wazuh-dashboard-fips, saf, actions-runner, homepage,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: dapr, grafana-fips, goose, sqlexporter, spqr, keda, splunk-otel-collector, gotrue, jitsucom-bulker, timescaledb-parallel-copy, step-issuer-fips, kube-bench, vault, flyte, wal-g, sqlexporter-fips, argo-workflows-fips, splunk-otel-collector-fips, step, cerbos,...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

The CVE describes an unchecked array index in Argo Workflows’ pod informer, specifically in podGCFromPod(), which can cause a controller-wide panic when a workflow pod has a malformed workflows.argoproj.io/pod-gc-strategy annotation. Affected versions span 3.6.5 through 4.0.4, with the panic occu...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

Argo Workflows 输入验证错误漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 3.6.5 to 4.0.4 of Argo Workflows contain a vulnerability related to input validation errors. This vulnerability stems from insufficient array index checking in the podGCFromPod...

PT-2026-34719

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 3.6.5 through 3.6.19 Argo Workflows versions 3.7.0-rc1 through 3.7.12 Argo Workflows versions 4.0.0-rc1 through 4.0.4 Description An unchecked array index in the pod informer's podGCFromPod function causes a...

CVE-2026-40886: Improper Validation of Array Index

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

GHSA-R4Q5-VMMM-2653 vulnerabilities

Vulnerabilities for packages: code-server, saf, kubeflow-katib, langfuse, kubeflow-pipelines, argo-workflows, opensearch-dashboards, prism, configurable-http-proxy, nextcloud-server, thingsboard, lerna...

CVE-2026-2950 vulnerabilities

Vulnerabilities for packages: arangodb, jitsucom-jitsu, drupal, kubeflow-centraldashboard, langfuse, langfuse-fips, ts-patch, gitlab-rails-ce-fips, sqlpad, kibana, py3-captum, semaphore, gitlab-rails-ce, kubeflow-katib, wazuh-dashboard-fips, saf, opensearch-dashboards, opensearch-dashboards-fips,...

GHSA-R5FR-RJXR-66JC vulnerabilities

Vulnerabilities for packages: arangodb, jitsucom-jitsu, drupal, kubeflow-centraldashboard, langfuse, langfuse-fips, ts-patch, gitlab-rails-ce-fips, sqlpad, kibana, py3-captum, semaphore, gitlab-rails-ce, kubeflow-katib, wazuh-dashboard-fips, saf, opensearch-dashboards, opensearch-dashboards-fips,...

CVE-2026-4800 vulnerabilities

Vulnerabilities for packages: arangodb, jitsucom-jitsu, drupal, kubeflow-centraldashboard, langfuse, langfuse-fips, ts-patch, gitlab-rails-ce-fips, sqlpad, kibana, py3-captum, semaphore, gitlab-rails-ce, kubeflow-katib, wazuh-dashboard-fips, saf, opensearch-dashboards, opensearch-dashboards-fips,...