Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin-approved templates. The podSpecPatch field on a submitted Workflow takes precedence over the referenced WorkflowTemplate during spec merging and is applied directly to the pod spec at creation time with no security validation. This vulnerability is fixed in 4.0.2 and 3.7.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-workflows | >= 4.0.0, < 4.0.2, >= 2.9.0, < 3.7.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260317T205859-150000.1.152.1 | SUSE-SU-2026:1042-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-apiserver +3 | 2.16.0-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-workflows | >= 2.9.0 | — | GHSA-3wf5-g532-rcrr |
| Go | github.com/argoproj/argo-workflows | all versions | — | GO-2026-4681 |
| Go | github.com/argoproj/argo-workflows/v2 | >= 2.9.0 | — | GO-2026-4681 |
| Go | github.com/argoproj/argo-workflows/v3 | < 3.7.11 | 3.7.11 | GHSA-3wf5-g532-rcrr |
| Go | github.com/argoproj/argo-workflows/v4 | < 4.0.2 | 4.0.2 | GHSA-3wf5-g532-rcrr |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:1042-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 26, 2026