Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M
CVE-2026-31892WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Critical 9.9
In plain English
A critical-severity incorrect authorization in argo-workflows from argoproj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin-approved templates. The podSpecPatch field on a submitted Workflow takes precedence over the referenced WorkflowTemplate during spec merging and is applied directly to the pod spec at creation time with no security validation. This vulnerability is fixed in 4.0.2 and 3.7.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/argoproj/argo-workflows | no fix listed | GO-2026-4681 |
| Go | github.com/argoproj/argo-workflows | no fix listed | GHSA-3wf5-g532-rcrr |
| Go | github.com/argoproj/argo-workflows/v2 | no fix listed | GO-2026-4681 |
| Go | github.com/argoproj/argo-workflows/v3 | 3.7.11 | GO-2026-4681 |
| Go | github.com/argoproj/argo-workflows/v3 | 3.7.11 | GHSA-3wf5-g532-rcrr |
| Go | github.com/argoproj/argo-workflows/v4 | 4.0.2 | GO-2026-4681 |
| Go | github.com/argoproj/argo-workflows/v4 | 4.0.2 | GHSA-3wf5-g532-rcrr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| argoproj | argo-workflows | >= 4.0.0, < 4.0.2>= 2.9.0, < 3.7.11 |
Weakness: CWE-863, CWE-807 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-3wf5-g532-rcrr x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-31892 vdb-entry, x_refsource_REDHAT
- RHBZ#2446551 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31892.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisory, x_refsource_REDHAT