{"id":"EUVD-2026-25267","enisaUuid":"638d7a94-22b5-3a8c-82ed-c503b2da0edd","description":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer\u0027s podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller\u0027s recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.","datePublished":"Apr 23, 2026, 6:12:05 PM","dateUpdated":"Jul 15, 2026, 1:00:32 AM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-5jv8-h7qh-rf5p\n","aliases":"CVE-2026-40886\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"770dc296-3e26-3712-8bc8-a9ce78cb0797","product":{"name":"argo-workflows","vendor":{"name":"argoproj"}},"product_version":"3.6.5, ≤ 3.6.19"},{"id":"cefd5a10-f139-3c08-8430-9207603d219a","product":{"name":"argo-workflows","vendor":{"name":"argoproj"}},"product_version":"3.7.0, \u003c 3.7.14"},{"id":"e5225214-1c51-3f79-9694-27325cb3f2c3","product":{"name":"argo-workflows","vendor":{"name":"argoproj"}},"product_version":"4.0.0, \u003c 4.0.5"}],"enisaIdVendor":[{"id":"2cc755c9-685f-3fe4-b22a-08babe216f1c","vendor":{"name":"argoproj"}}],"enisaIdVulnerability":[{"id":"016b885e-0b24-3eef-89d3-36e299a94d82","vulnerability":{"id":"CVE-2026-40886","description":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer\u0027s podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller\u0027s recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.","datePublished":"Apr 23, 2026, 6:12:05 PM","dateUpdated":"Jul 15, 2026, 1:00:32 AM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-5jv8-h7qh-rf5p\n","enisa_id":"EUVD-2026-25267\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Oct 27, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"591d7bad-1fcf-36e7-a7b2-61bc78512850","product":{"name":"argo-workflows","vendor":{"name":"argoproj"}},"product_version":"4.0.0, \u003c 4.0.5"},{"id":"5b9b94e1-5448-3ba7-b157-c8deb88a55c3","product":{"name":"argo-workflows","vendor":{"name":"argoproj"}},"product_version":"3.6.5, ≤ 3.6.19"},{"id":"8494930d-9eb6-3cac-886d-88c456073484","product":{"name":"argo-workflows","vendor":{"name":"argoproj"}},"product_version":"3.7.0, \u003c 3.7.14"}],"vulnerabilityVendor":[{"id":"6184ee6a-5134-3966-a5ca-01a9f10abf1b","vendor":{"name":"argoproj"}}]}},{"id":"ee23cc99-ca77-30b3-8009-1b3801b06fa3","vulnerability":{"id":"GHSA-5jv8-h7qh-rf5p","description":"Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller","datePublished":"Apr 23, 2026, 9:39:21 PM","dateUpdated":"Apr 23, 2026, 9:39:21 PM","baseScore":0.0,"references":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-5jv8-h7qh-rf5p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40886\nhttps://github.com/argoproj/argo-workflows\n","enisa_id":"EUVD-2026-25267\n","aliases":"CVE-2026-40886\nGHSA-5jv8-h7qh-rf5p\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}