EUVD-2026-337269

fkie_cve-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.

GHSA-5jv8-h7qh-rf5p — Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

Affected: Go: github.com/argoproj/argo-workflows/v4, Go: github.com/argoproj/argo-workflows/v3

### Summary

An unchecked array index in the pod informer's `podGCFromPod()` function causes a controller-wide panic when a workflow pod carries a malformed `workflows.argoproj.io/pod-gc-strategy` annotation. Because the panic occurs inside an informer goroutine (outside the controller's `recover()` scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted.

### Details

`podGCFromPod()` splits the annotation value on "/" and unconditionally accesses `parts[1]`:

```go func podGCFromPod(pod *apiv1.Pod) wfv1.PodGC { if val, ok := pod.Annotations[common.AnnotationKeyPodGCStrategy]; ok { parts := strings.Split(val, "/") return wfv1.PodGC{Strategy: wfv1.PodGCStrategy(parts[0]), DeleteDelayDuration: parts[1]} } return wfv1.PodGC{Strategy: wfv1.PodGCOnPodNone} } ```

If the annotation value contains no "/", `parts` has length 1 and `parts[1]` panics with index out of range.

The code was introduced in [#14129](https://github.com/argoproj/argo-workflows/issues/14129) and affects versions:

- 3.6.x: v3.6.5 through v3.6.19 (backport in [#14263](https://github.com/argoproj/argo-workflows/issues/14263)) - 3.7.x: v3.7.0-rc1 through v3.7.12 - 4.x: v4.0.0-rc1 through v4.0.3 - Not affected: v3.6.4 and earlier

### PoC

Apply this workflow to a cluster running the Argo Workflows controller:

```bash kubectl apply -n argo -f - <<'EO…

Most recent entries from all

EUVD-2026-337269

fkie_cve-2026-40886

GHSA-5jv8-h7qh-rf5p — Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller