CVE-2026-40886 Details
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.
A denial-of-service vulnerability has been identified in Argo Workflows versions 3.6.5 through 4.0.4. The issue arises from an unchecked array index in the pod informer's 'podGCFromPod()' function. When a workflow pod contains a malformed 'workflows.argoproj.io/pod-gc-strategy' annotation, it triggers a controller-wide panic. This panic occurs within an informer goroutine, bypassing the controller's recovery mechanism, and crashes the entire controller process. The affected pod persists across restarts, creating a crash loop that disrupts all workflow processing until the pod is manually deleted.
Users can upgrade to Argo Workflows versions 4.0.5 or 3.7.14, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-40886 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2461236 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40886.json | redhat-SADP | |
| https://github.com/argoproj/argo-workflows/security/advisories/GHSA-5jv8-h7qh-rf5p | CISA-ADP | ExploitVendor Advisory |
| https://github.com/argoproj/argo-workflows/security/advisories/GHSA-5jv8-h7qh-rf5p | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | redhat-SADP |
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| argoproj argo workflows | >= 3.6.5, <= 3.6.19 >= 3.7.0, < 3.7.14 >= 4.0.0, < 4.0.5 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 25, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | New CVE Received | [email protected] |