Argo Workflows CVE-2026-31892: Incomplete Fix Detected
- Severity
- HIGH
- Affected component
- argo-workflows (go)
- Affected versions
- >= v4.0.1, <= v4.0.1 or >= v4.0.0, <= v4.0.0
- Patched version
- Not yet available
An incomplete fix for CVE-2026-31892 in Argo Workflows allows potential arbitrary code injection. Users of affected versions should take immediate action.
What happened
An early warning has been issued regarding an incomplete fix for CVE-2026-31892 in Argo Workflows. This vulnerability, tracked as GHSA-48P8-G2FX-3WWM, permits users to inject arbitrary strategic merge patches into the artifact-GC pod. The allow-list intended to mitigate this issue is reportedly insufficient, leaving systems vulnerable. The affected component is argo-workflows (go), specifically versions >= v4.0.1, <= v4.0.1 or >= v4.0.0, <= v4.0.0.
This vulnerability has not been exploited in the wild as of the latest reports. However, the potential for exploitation is significant, necessitating prompt attention from users of the affected versions. The issue lies in the ArtifactGC.PodSpecPatch, which bypasses the Strict/Secure template reference allow-list.
What to do about it
- Monitor the primary sources for updates on this vulnerability.
- Consider restricting the use of `templateReferencing: Strict` or `Secure` in your configurations until a fix is released.
- Review your current Argo Workflows configurations for any use of the affected versions and assess your exposure.
- Implement additional monitoring for any unusual activity related to the artifact-GC pod.
- No official fix has been published yet. Continue to monitor the sources below for updates.
How 0Day would have caught this
argo-workflows is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using argo-workflows (go) versions >= v4.0.1, <= v4.0.1 or >= v4.0.0, <= v4.0.0.
What should I do right now?
Monitor for patches and consider restricting the use of `templateReferencing: Strict` or `Secure` until a fix is released.
Has this vulnerability been exploited in the wild?
No, there are no reports of this vulnerability being exploited in the wild as of the latest information.