github.com/argoproj/argo-workflows: Argo Workflows: Security bypass allows privilege escalation via podSpecPatch field (CVE-2026-31892)

Overview

A flaw was found in Argo Workflows. A user with privileges to submit workflows can bypass security settings defined in a WorkflowTemplate by including a podSpecPatch field in their workflow submission. This allows them to circumvent restrictions, even when templateReferencing: Strict is configured, potentially leading to unauthorized resource access or privilege escalation.

Vendor advisories

• RHSA-2026:10184 · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · advisory

github.com/argoproj/argo-workflows: Argo Workflows: Security bypass allows privilege escalation via podSpecPatch field — rated Important by Red Hat. Released 2026-03-11, updated 2026-09-23.

Fixed:

• Red Hat OpenShift AI 2.25

Not affected:

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI (RHOAI)

Remediation

For Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184

Package advisory (CVE-2026-31892)

Affected packages:

• github.com/argoproj/argo-workflows/v4 < 4.0.2
• github.com/argoproj/argo-workflows/v3 < 3.7.11
• github.com/argoproj/argo-workflows >= 2.9.0

Patched in:

• github.com/argoproj/argo-workflows/v4 4.0.2
• github.com/argoproj/argo-workflows/v3 3.7.11

Source: https://osv.dev/vulnerability/GHSA-3wf5-g532-rcrr