DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54526: CVE-2026-54526: Strict Template Referencing Bypass and Privilege Escalation in Argo Workflows

#security #cve #cybersecurity

CVE-2026-54526: Strict Template Referencing Bypass and Privilege Escalation in Argo Workflows

Vulnerability ID: CVE-2026-54526
CVSS Score: 9.9
Published: 2026-08-13

A critical security bypass vulnerability in Argo Workflows allows authenticated attackers with workflow submission privileges to bypass 'Strict' or 'Secure' template referencing restrictions. By injecting unvalidated fields into the nested ArtifactGC configuration, attackers can execute arbitrary pod patches, leading to host namespace escape and cluster-wide privilege escalation.

TL;DR

Argo Workflows fails to recursively validate the ArtifactGC structure during template override sanitization, enabling attackers to inject custom pod spec patches and service accounts to compromise worker nodes.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-284
  • Attack Vector: Network
  • CVSS v3.1: 9.9 (Critical)
  • CVSS v4.0: 8.9 (High)
  • Exploit Maturity: Proof-of-Concept / Technical Bypass
  • CISA KEV Status: Not Listed
  • Ransomware Use: No

Affected Systems

  • Argo Workflows
  • Argo Workflows: >= 3.7.0, < 3.7.15 (Fixed in: v3.7.15)
  • Argo Workflows: >= 4.0.0, < 4.0.6 (Fixed in: v4.0.6)

Code Analysis

Commit: 277e9ce

Fix: validation bypass in template referencing via ArtifactGC nested fields

Commit: 358cc39

Cherry-pick fix: validation bypass in template referencing via ArtifactGC nested fields to 4.0 release branch

Mitigation Strategies

  • Upgrade to Argo Workflows v3.7.15, v4.0.6, or later versions.
  • Deploy Kyverno or OPA Gatekeeper policies to reject Workflow submissions with nested ServiceAccountName or PodSpecPatch in ArtifactGC.
  • Apply least-privilege RBAC to all workflow service accounts to minimize the blast radius of a potential compromise.

Remediation Steps:

  1. Identify current deployed versions of Argo Workflows across all clusters.
  2. Apply the update to v3.7.15 (for 3.7.x) or v4.0.6 (for 4.0.x) using Helm or kubectl apply.
  3. Verify the installation by testing workflow submissions with custom podSpecPatch fields under ArtifactGC to ensure they are blocked.
  4. Monitor controller logs for any validation errors indicating rejected submissions containing unauthorized overrides.

References

Read the full report for CVE-2026-54526 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)