Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.6.5, <= 3.6.19CPE matchmatch criteria | cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* | ||
>= 3.7.0, < 3.7.14CPE matchmatch criteria | cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* | ||
>= 4.0.0, < 4.0.5CPE matchmatch criteria | cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.