CVE-2026-54526 is a critical flaw (CVSS 9.9) in Argo Workflows. A previous fix for CVE-2026-31892 missed the artifactGC field, so a user can still inject a pod patch into the artifact garbage collection pod and defeat Strict or Secure template referencing. It is fixed in 3.7.15 and 4.0.6.
What's affected
- Argo Workflows before 3.7.15 on the 3.x line and before 4.0.6 on the 4.x line, per the record.
- Fixed in 3.7.15 and 4.0.6.
- Clusters that rely on templateReferencing set to Strict or Secure to stop users from changing the pod specification.
How to check if you're exposed
Check the controller version.
argo version
kubectl get deploy -A | grep workflow-controller
kubectl get deploy -n <namespace> workflow-controller -o jsonpath='{.spec.template.spec.containers[0].image}'
Then check the templateReferencing setting in the workflow controller configmap. If it is Strict or Secure, you were counting on the very control this CVE weakens. Also list who can submit workflows.
What to do now
- Upgrade the controller to 3.7.15 or 4.0.6, or later on your line.
- Make sure you had also applied the earlier fixes for CVE-2026-31892 and the follow-up advisory it references.
- Restrict who can submit workflows to namespaces with limited service accounts.
- Apply pod security controls in the cluster so a patched pod still cannot use hostPath volumes or run privileged.
- Review recent artifact GC pods for unusual images, commands or host mounts.
Why it matters
The class is CWE-284, improper access control. The advisory explains that the allow list walked only the top level fields of the workflow spec. The artifactGC field was allowed as a whole, and one of its sub-fields flows into the same pod patch function that the first fix had closed.
A partial allow list is a common failure. When a field is allowed wholesale, every nested field comes along. The record does not mark the CVE as exploited in the wild. Admission policies in the cluster provide a second layer even when a workflow engine has a gap.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Why is the score 9.9 when the attacker needs to submit workflows?
The scope changes. A patched pod can use host level settings, so the effect reaches beyond the workflow engine to the node.
Sources
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-48p8-g2fx-3wwm
- https://github.com/argoproj/argo-workflows/releases/tag/v3.7.15
- https://github.com/argoproj/argo-workflows/releases/tag/v4.0.6
Last reviewed: 19 October 2026.
