https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T19:34:12.964380+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337269 EUVD-2026-337269 2026-10-06T19:34:13.016436+00:00 EUVD-2026-337269 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40886 fkie_cve-2026-40886 2026-10-06T19:34:13.016477+00:00

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.

 https://cve.radiocsirt.org/vuln/ghsa-5jv8-h7qh-rf5p GHSA-5jv8-h7qh-rf5p — Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller 2026-10-06T19:34:13.016516+00:00

Affected: Go: github.com/argoproj/argo-workflows/v4, Go: github.com/argoproj/argo-workflows/v3

### Summary

An unchecked array index in the pod informer's `podGCFromPod()` function causes a controller-wide panic when a workflow pod carries a malformed `workflows.argoproj.io/pod-gc-strategy` annotation. Because the panic occurs inside an informer goroutine (outside the controller's `recover()` scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted.

### Details

`podGCFromPod()` splits the annotation value on "/" and unconditionally accesses `parts[1]`:

```go func podGCFromPod(pod *apiv1.Pod) wfv1.PodGC { if val, ok := pod.Annotations[common.AnnotationKeyPodGCStrategy]; ok { parts := strings.Split(val, "/") return wfv1.PodGC{Strategy: wfv1.PodGCStrategy(parts[0]), DeleteDelayDuration: parts[1]} } return wfv1.PodGC{Strategy: wfv1.PodGCOnPodNone} } ```

If the annotation value contains no "/", `parts` has length 1 and `parts[1]` panics with index out of range.

The code was introduced in [#14129](https://github.com/argoproj/argo-workflows/issues/14129) and affects versions:

- 3.6.x: v3.6.5 through v3.6.19 (backport in [#14263](https://github.com/argoproj/argo-workflows/issues/14263)) - 3.7.x: v3.7.0-rc1 through v3.7.12 - 4.x: v4.0.0-rc1 through v4.0.3 - Not affected: v3.6.4 and earlier

### PoC

Apply this workflow to a cluster running the Argo Workflows controller:

```bash kubectl apply -n argo -f - <<'EO…