CVE-2026-31892: argoproj argo_workflows Incorrect Authorization

Vulnerability summary

CVE-2026-31892 is a critical (CVSS 9.9) Incorrect Authorization vulnerability in argoproj argo_workflows. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-03-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin-approved templates. The podSpecPatch field on a submitted Workflow takes precedence over the referenced WorkflowTemplate during spec merging and is applied directly to the pod spec at creation time with no security validation. This vulnerability is fixed in 4.0.2 and 3.7.11.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-807Reliance on Untrusted Inputs in a Security DecisionThe product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.