Argo Workflows Crash Loop: Malformed Annotation Halts Processing

The National Vulnerability Database has detailed CVE-2026-40886, a high-severity vulnerability (CVSS 7.7) affecting Argo Workflows versions 3.6.5 to 4.0.4. This flaw, categorized under CWE-129 (Improper Handling of Array Index), stems from an unchecked array index within the podGCFromPod() function. Specifically, a malformed workflows.argoproj.io/pod-gc-strategy annotation on a workflow pod can trigger a controller-wide panic.

This isn’t just a minor hiccup; the panic occurs outside the controller’s recovery scope, leading to a complete crash of the entire controller process. Worse, the poisoned pod persists across restarts, causing a persistent crash loop. The result? All workflow processing grinds to a halt until the offending pod is manually identified and deleted. This effectively creates a denial of service for any environment relying on Argo Workflows for orchestration.

Defenders need to understand the attacker’s calculus here: this is an availability play. While not directly leading to data exfiltration or arbitrary code execution, it provides a straightforward way to disrupt critical Kubernetes-native operations. The vulnerability is addressed in Argo Workflows versions 4.0.5 and 3.7.14.