CVE-2026-54526

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.7.15 Argo Workflows versions prior to 4.0.6

Description An incomplete allow-list implementation in the ValidateUserOverrides and SanitizeUserWorkflowSpec functions within workflow/util/merge.go allows for the injection of arbitrary strategic merge patches. The WorkflowSpec.ArtifactGC field is allow-listed entirely, and its underlying WorkflowLevelArtifactGC struct contains a PodSpecPatch sub-field. This allows a user submitting a Workflow under templateReferencing: Strict or Secure modes, while setting spec.artifactGC.strategy: OnWorkflowCompletion against a referenced WorkflowTemplate with an output artifact, to inject malicious configurations into the artifact-GC pod. Potential impacts include the use of hostPath volumes, setting privileged: true, executing arbitrary images and commands, and enabling hostNetwork: true, which bypasses the security restrictions of the Strict and Secure reference modes.

Recommendations Update to version 3.7.15 or later. Update to version 4.0.6 or later.