9.9

CVE-2026-54526: argoproj argo_workflows Improper Access Control

CVSS: 9.9v3.1CriticalAnalyzed
AliasesCGA-273x-5hv2-c3q6CGA-2c6g-r3j3-jxq4CGA-4jr6-46hf-c6f8
Published 16-07-2026Last modified 17-07-2026
Open JSON

Vulnerability summary

CVE-2026-54526 is a critical (CVSS 9.9) Improper Access Control vulnerability in argoproj argo_workflows. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.9/10
010
Critical · v3.1 (NVD)
EPSS score
0.55%
0%100%
Low · +0.19 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:21761-1SUSE-SU-2026:23625-1CGA-85GM-M2HW-QG6J

Timeline

  1. 16-07-2026
    PublishedVulnerability first disclosed.
  2. 17-07-2026
    Last modifiedVulnerability information updated.

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection, and WorkflowSpec.ArtifactGC is allow-listed wholesale; the struct behind that field, WorkflowLevelArtifactGC, has a PodSpecPatch sub-field whose contents flow unmodified into util.ApplyPodSpecPatch on the artifact-GC pod, the same sink the original fix closed for WorkflowSpec.PodSpecPatch, so a user submitting a Workflow under templateReferencing: Strict or Secure (against a referenced WorkflowTemplate that declares an output artifact and setting spec.artifactGC.strategy: OnWorkflowCompletion) can still inject an arbitrary strategic merge patch into the artifact-GC pod, including hostPath volumes, privileged: true, arbitrary image and command, and hostNetwork: true, defeating the stated purpose of Strict/Secure reference mode. This issue is fixed in versions 3.7.15 and 4.0.6.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

+0.19 pp

From 0.36% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Argo Workflows

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard13 products
  • kfp-driver< 2.17.0-r6
  • kubeflow-pipelines-apiserver< 2.17.2-r4 | < 2.17.0-r6
  • kubeflow-pipelines-apiserver-fips< 2.17.0-r9
  • kubeflow-pipelines-cache_server< 2.17.0-r6
  • kubeflow-pipelines-cache_server-fips< 2.17.0-r9
Wolfi5 products
  • kubeflow-pipelines-apiserver< 2.17.2-r4 | < 2.17.0-r6
  • kubeflow-pipelines-cache_server< 2.17.0-r6
  • kubeflow-pipelines-metadata-writer-compat< 2.17.2-r4
  • kubeflow-pipelines-persistence_agent< 2.17.0-r6
  • kubeflow-pipelines-scheduledworkflow< 2.17.0-r6
Github.com/argoproj/argo-workflows3 products
  • v2All versions (No fix recorded)
  • v3< 3.7.15
  • v4≥ 4.0.0, < 4.0.6
Argoproj2 products
Github.com/argoproj1 product
  • argo-workflows≤ 2.5.3-rc4 | All versions (No fix recorded)

5 vendors · 24 products

References

8 links