Argo WorkflowsApplication · Argoproj
CVE-2026-54526
A fix is available.
Upgrade to 3.7.15 / 4.0.6 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable
Zero-click
5 weeks old
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedArgo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection, and WorkflowSpec.ArtifactGC is allow-listed wholesale; the struct behind that field, WorkflowLevelArtifactGC, has a PodSpecPatch sub-field whose contents flow unmodified into util.ApplyPodSpecPatch on the artifact-GC pod, the same sink the original fix closed for WorkflowSpec.PodSpecPatch, so a user submitting a Workflow under templateReferencing: Strict or Secure (against a referenced WorkflowTemplate that declares an output artifact and setting spec.artifactGC.strategy: OnWorkflowCompletion) can still inject an arbitrary strategic merge patch into the artifact-GC pod, including hostPath volumes, privileged: true, arbitrary image and command, and hostNetwork: true, defeating the stated purpose of Strict/Secure reference mode. This issue is fixed in versions 3.7.15 and 4.0.6.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · low confidenceDeveloping — this CVE was published recently and its authoritative NVD entry is still being established, so we're holding a technical summary until the source data settles rather than publish something unreliable. Re-checking after 2026-07-30.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Argo WorkflowsApplication
Affected:
< 3.7.15>= 4.0.0, < 4.0.6CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped
Upgrade available
Upgrade to 3.7.15 / 4.0.6 or later
Fixed in
3.7.154.0.6
Recommended fix
High confidence
3.7.15 (for 3.x line) or 4.0.6 (for 4.x line)
- 1. Identify the current Argo Workflows version in use (e.g., via `argo version` or Kubernetes deployment)
- 2. If running a 3.x version prior to 3.7.15, plan upgrade to version 3.7.15
- 3. If running a 4.x version prior to 4.0.6, plan upgrade to version 4.0.6
- 4. Backup current Argo Workflows configuration and any custom resources
- 5. Perform the upgrade using the standard upgrade method for the deployment (e.g., Helm upgrade, kubectl apply, or operator update)
- 6. Verify the new version is running (e.g., `argo version`)
- 7. Test that workflows with `templateReferencing: Strict` or `Secure` and artifactGC.strategy: OnWorkflowCompletion cannot inject arbitrary pod patches
Caveat Review the 3.7.15 and 4.0.6 release notes for any breaking changes; minor version upgrades typically have minimal risk
Generated from the published advisory — verify against the referenced sources before acting.
We can perform the upgrade in your staging environment and verify nothing breaks — typical engagement from $2,300.
Get the upgrade done
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2026-54526 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-54526 in production — separate from our analysis above.
Know something about CVE-2026-54526?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data