CVE-2026-31892

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31892
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31892.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31892
Aliases
Related
Published
2026-03-11T15:41:14.376Z
Modified
2026-03-13T11:36:38.098748Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Details

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin-approved templates. The podSpecPatch field on a submitted Workflow takes precedence over the referenced WorkflowTemplate during spec merging and is applied directly to the pod spec at creation time with no security validation. This vulnerability is fixed in 4.0.2 and 3.7.11.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31892.json"
}
References

Affected packages

Git / github.com/argoproj/argo-workflows

Affected ranges

Type
GIT
Repo
https://github.com/argoproj/argo-workflows
Events
Introduced
a8bff4a72130bc1a13d95c6f73ff3fafec880287
Fixed
32afec3c401c0920517bf1e890fa7dba6170cdf2
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/argoproj/argo-workflows
Events
Introduced
d67d3b1dbc61ebc5789806794ccd7e2debd71ffc
Fixed
8aad740bb4fb4698f0463e2106d8e1dfafbe72cd
Database specific 
{
    "versions": [
        {
            "introduced": "2.9.0"
        },
        {
            "fixed": "3.7.11"
        }
    ]
}

Affected versions

v4.*
v4.0.0
v4.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31892.json"