Skip to content
Advisories.
argo-workflowsGO-2026-5148

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows

UnratedCVE-2026-40886 · Published Jun 25, 2026 · updated Jun 26, 2026

Source advisory

Affected versions

PackageAffectedFixed in
github.com/argoproj/argo-workflows
Go
all versionsNo fix yet
Details and references

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows

Severity from
no source yet
Also known as
BIT-argo-workflows-2026-40886, CVE-2026-40886, GHSA-5jv8-h7qh-rf5p

More argo-workflows advisories

All
DateAdvisory
Jun 25Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows
CVE-2026-42296High8.1no fix yet
Jun 25Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows
CVE-2026-42295Medium4.9no fix yet
Jun 25Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows
CVE-2026-42294High7.5no fix yet
Jun 25Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows
CVE-2026-42183Medium6.5no fix yet
Jun 25Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows
CVE-2026-42297High8.3no fix yet
Aug 13Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
CVE-2026-54526Highno fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.