Argo Workflows CVE-2026-40886

Exploitation requires the attacker to be able to create a Kubernetes pod/Workflow in a cluster running an affected Argo Workflows controller and to set the pod annotation workflows.argoproj.io/pod-gc-strategy to a value containing no '/' character (e.g. 'NoSlash') - that malformed annotation is itself the trigger. This corresponds to CVSS PR:L: the attacker needs workflow-submission or pod-create RBAC, so a fully external unauthenticated attacker cannot reach it directly. No user interaction, no non-default feature flag, and no special platform are needed - the vulnerable podGCFromPod() code path is always active. Limiting factors: clusters where only trusted operators can submit workflows sharply reduce real-world risk, and the effect is availability-only with no data disclosure or code execution; the primary practical constraint is possession of workflow/pod-creation rights in the controller's watched namespaces.

The signals are internally consistent and point to a genuine but bounded availability threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7 High) fits well: network-reachable, low complexity, but requiring some privilege (PR:L) because the attacker must be authorized to create a Workflow or pod carrying the annotation, with a scope change since one workflow's pod takes down the shared controller, and pure availability impact (no confidentiality or integrity loss). EPSS is 0.04% (12th percentile) and there is no CISA KEV listing, so widespread opportunistic exploitation is unlikely; however a public PoC exists and reproduction is trivial, so the barrier is low for anyone who already holds submit access. SSVC records Automatable: no (a valid annotation must be crafted and submitted, not mass-sprayed) and Technical Impact: partial. Net assessment: a real, high-priority DoS for multi-tenant Argo clusters where workflow submission is delegated to semi-trusted users, but a low-priority issue where only trusted operators can submit workflows. No conflicting data was identified; the key nuance is that the impact is availability-only despite the network attack vector.

A tenant with permission to submit workflows in a shared Argo namespace applies a Workflow whose podMetadata sets workflows.argoproj.io/pod-gc-strategy to a value with no slash, such as 'NoSlash'. Within seconds the controller reads the annotation via the pod informer, panics on parts[1], and drops into CrashLoopBackOff, halting all workflow processing for every tenant until an operator locates and deletes the offending pod. A copy-paste PoC manifest is published in the GHSA advisory, so no exploit development is required.