argo-workflowsGO-2026-5072

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

High8.1CVE-2026-42296 · Published Jun 25, 2026

Source advisory

Affected versions

Package	Affected	Fixed in
github.com/argoproj/argo-workflows Go	all versions	No fix yet

Changes since it was listed

Date	Change
Sep 25	Severity: Unrated to High

Details and references

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from: NVD
Also known as: BIT-argo-workflows-2026-42296, CVE-2026-42296, GHSA-3775-99mw-8rp4

More argo-workflows advisories

Date	Advisory	Severity	Fixed in
Jun 25	Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows CVE-2026-40886Unratedno fix yet	Unrated	No fix yet
Jun 25	Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows CVE-2026-42295Medium4.9no fix yet	Medium4.9	No fix yet
Jun 25	Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows CVE-2026-42294High7.5no fix yet	High7.5	No fix yet
Jun 25	Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows CVE-2026-42183Medium6.5no fix yet	Medium6.5	No fix yet
Jun 25	Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows CVE-2026-42297High8.3no fix yet	High8.3	No fix yet
Aug 13	Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) CVE-2026-54526Highno fix yet	High	No fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.