{"id":"CVE-2026-54526","published":"2026-07-16T19:07:30Z","modified":"2026-07-17T13:57:43Z","title":"Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing","vendor":"argoproj","product":"argo-workflows","tier":"tail","description":{"text":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection, and WorkflowSpec.ArtifactGC is allow-listed wholesale; the struct behind that field, WorkflowLevelArtifactGC, has a PodSpecPatch sub-field whose contents flow unmodified into util.ApplyPodSpecPatch on the artifact-GC pod, the same sink the original fix closed for WorkflowSpec.PodSpecPatch, so a user submitting a Workflow under templateReferencing: Strict or Secure (against a referenced WorkflowTemplate that declares an output artifact and setting spec.artifactGC.strategy: OnWorkflowCompletion) can still inject an arbitrary strategic merge patch into the artifact-GC pod, including hostPath volumes, privileged: true, arbitrary image and command, and hostNetwork: true, defeating the stated purpose of Strict/Secure reference mode. This issue is fixed in versions 3.7.15 and 4.0.6.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.9,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00553,"percentile":0.46054,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-48p8-g2fx-3wwm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-workflows/commit/277e9cef0ad16d7eaaab253573d0695951a65dbd","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-workflows/commit/358cc3968c8f06f1be0967e41df191088db0b662","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-workflows/releases/tag/v3.7.15","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-workflows/releases/tag/v4.0.6","tags":["x_refsource_MISC"]}],"priority":{"score":15.4,"factors":[{"name":"EPSS percentile","points":9.21},{"name":"CVSS severity","points":6.23}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-workflows","versions":["< 3.7.15",">= 4.0.0, < 4.0.6"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-workflows/v4","vulnerableRanges":[">=4.0.0, <4.0.6"],"patched":["4.0.6"],"from":["GHSA-48p8-g2fx-3wwm","GO-2026-6223"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-workflows/v3","vulnerableRanges":["<3.7.15"],"patched":["3.7.15"],"from":["GHSA-48p8-g2fx-3wwm","GO-2026-6223"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-workflows","vulnerableRanges":["<=2.5.3-rc4","all versions"],"patched":[],"from":["GHSA-48p8-g2fx-3wwm","GO-2026-6223"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-workflows/v2","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2026-6223"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-45029","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-workflows-cve-2026-31892","parents":[{"from":"CVE-2026-31892","to":"CVE-2026-54526","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection, and WorkflowSp…","from":"CVE.org","in":"CVE-2026-54526"}]}],"packageHistory":[{"cve":"CVE-2026-40886","published":"2026-04-23","fixed":"3.7.14","kev":false},{"cve":"CVE-2026-42294","published":"2026-05-09","fixed":"3.7.14","kev":false,"link":{"from":"CVE-2026-42294","to":"CVE-2026-54526","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-workflows/v3","fromFixed":"3.7.14","toFixed":"3.7.15","daysApart":68}]}},{"cve":"CVE-2026-42296","published":"2026-05-09","fixed":"3.7.14","kev":false},{"cve":"CVE-2026-54526","published":"2026-07-16","fixed":"3.7.15","kev":false}],"package":"Go:github.com/argoproj/argo-workflows/v3"}}