CVE-2026-40886

argoproj argo workflows

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-40886

Katalog CVE

CVSS 7.7 · High EPSS 0,59%

Kerentanan Improper Validation of Array Index pada argoproj argo workflows. Skor CVSS 3.1 7.7 (High) menurut github.com.

Deskripsi (NVD)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.

Rincian

Terbit di NVD
23 April 2026
Terakhir diubah
15 Juli 2026
Status NVD
Modified
CVSS 3.1
7.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-129: Improper Validation of Array Index
CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
EPSS (30 hari)
0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
argoproj argo workflows Versi 3.6.5 hingga 3.6.19
argoproj argo workflows Versi 3.7.0 hingga sebelum 3.7.14
argoproj argo workflows Versi 4.0.0 hingga sebelum 4.0.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.