Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Affected products
- argoproj / argo-workflows>= 4.0.0, < 4.0.5 – >= 4.0.0, < 4.0.5
- argoproj / argo-workflows>= 3.7.0, < 3.7.14 – >= 3.7.0, < 3.7.14
- argoproj / argo-workflows>= 3.6.5, <= 3.6.19 – >= 3.6.5, <= 3.6.19