Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

EUVD-2026-25267

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller...

GHSA-5JV8-H7QH-RF5P Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Summary An unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine outside the controller's recover scope, it...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: saf, argo-workflows, renovate, kubeflow-katib, kubeflow-pipelines, npm, opensearch-dashboards, prism, sqlpad, jitsucom-jitsu, tensorflow-cpu-jupyter, kubeflow-centraldashboard, langfuse, py3-jupyterlab, code-server...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: azure-service-operator, juicefs, cloudnative-pg, kubeflow-pipelines, src, kube-bench, splunk-otel-collector, keda, openfga, spire-server, timescaledb-parallel-copy, kine, wal-g, opentelemetry-collector-contrib, step-ca, step-issuer, jitsucom-bulker, gitaly, gitness,...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: kibana, opensearch-dashboards-fips, wazuh-dashboard, librechat, tensorflow-cpu-jupyter, jitsucom-jitsu, py3-captum, wazuh-dashboard-fips, argo-workflows, gitlab-rails-ce-fips, nextcloud-server, code-server, langfuse-fips, kubeflow-centraldashboard, langfuse,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: gitlab-kas-fips, cerbos, peerdb-flow, splunk-otel-collector-fips, spire-server, certificate-transparency, argo-workflows, seaweedfs-rocksdb-fips, step-ca, trillian-fips, vault, teleport, sqlexporter, telegraf, goose-fips, sqlexporter-fips, envoy-gateway-fips,...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

The CVE describes an unchecked array index in Argo Workflows’ pod informer, specifically in podGCFromPod(), which can cause a controller-wide panic when a workflow pod has a malformed workflows.argoproj.io/pod-gc-strategy annotation. Affected versions span 3.6.5 through 4.0.4, with the panic occu...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

PT-2026-34719

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 3.6.5 through 3.6.19 Argo Workflows versions 3.7.0-rc1 through 3.7.12 Argo Workflows versions 4.0.0-rc1 through 4.0.4 Description An unchecked array index in the pod informer's podGCFromPod function causes a...

Argo Workflows 输入验证错误漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 3.6.5 to 4.0.4 of Argo Workflows contain a vulnerability related to input validation errors. This vulnerability stems from insufficient array index checking in the podGCFromPod...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: pulumi, guac, src-fingerprint, crossplane, kots, osv-scanner, pulumi-language-java, flux-image-automation-controller, pulumi-language-yaml, gitsign, scorecard, kubescape, argocd-image-updater, gomplate, pulumi-language-dotnet, external-secrets-operator, kubevela,...

GHSA-R4Q5-VMMM-2653 vulnerabilities

Vulnerabilities for packages: saf, argo-workflows, nextcloud-server, thingsboard, kubeflow-katib, kubeflow-pipelines, opensearch-dashboards, prism, lerna, langfuse, configurable-http-proxy, code-server...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: gitlab-kas-fips, aws-node-termination-handler-fips, trident, cilium-fips, tigera-operator, verticadb-operator-fips, argo-workflows, argo-cd-fips, teleport, terraform-provider-kubernetes-fips, kubernetes-dashboard-api, kubevela, argo-cd, tigera-operator-fips,...

CLEANSTART-2026-BH97849 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the argo-cd package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CVE-2026-6388 Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates ...

CVE-2026-6388

The CVE describes a vulnerability in ArgoCD Image Updater where a user with rights to create/modify an ImageUpdater in a multi-tenant environment can bypass namespace boundaries due to insufficient validation. This leads to cross-namespace privilege escalation and unauthorized image updates on ap...