Argo Workflows CVE-2026-54526

Exploitation requires an authenticated user with rights to submit a Workflow (CVSS PR:L) that references a WorkflowTemplate under templateReferencing: Strict or Secure mode, where that referenced WorkflowTemplate declares an output artifact AND the submitted workflow sets spec.artifactGC.strategy: OnWorkflowCompletion; the malicious payload is placed in the nested spec.artifactGC.podSpecPatch (WorkflowLevelArtifactGC.PodSpecPatch) field. Limiting factors: it only works on versions before 3.7.15/4.0.6; it needs artifact GC to actually run (an output artifact plus a GC strategy), so clusters that do not use artifact GC or WorkflowTemplate references are not exposed; and it needs the ability to submit workflows, so pure read-only or non-submitting users cannot trigger it. This is the exact deployment mode (Strict/Secure) whose security guarantee the bug defeats - the AT:P bit in the CVSS 4.0 vector reflects these required configuration prerequisites.

This is a genuinely high-impact issue but a conditional, authenticated one, not a spray-and-pray internet exploit. The provided CVSS 4.0 vector (8.9, AV:N/AC:L/AT:P/PR:L/UI:N) shows network-reachable API exploitation by a low-privileged user, with the AT:P (attack requirements present) bit correctly reflecting that the target environment must be configured a specific way - a referenced WorkflowTemplate declaring an output artifact plus artifactGC strategy OnWorkflowCompletion, under Strict/Secure reference mode. High confidentiality and integrity impact on both the vulnerable and subsequent systems (VC:H/VI:H/SC:H/SI:H/SA:H) is consistent with a privileged pod that can mount hostPath and use hostNetwork, effectively enabling node/cluster compromise. No EPSS score, no KEV listing, and no POC were provided, so real-world exploitation pressure is currently unquantified - the main public artifact is the fix commit itself, which does aid reverse-engineering. Net: prioritize patching where Strict/Secure reference mode with artifact GC is actually in use, because the whole point of that mode (isolating multi-tenant submitters from privileged templates) is defeated; environments not using WorkflowTemplate references or artifact GC are not exposed by this specific bypass.

A tenant with permission only to submit Workflows references a hardened WorkflowTemplate (Strict/Secure mode) that declares an output artifact, and sets spec.artifactGC.strategy: OnWorkflowCompletion plus a spec.artifactGC.podSpecPatch containing privileged: true, a hostPath mount of the node root, hostNetwork: true, and an attacker image and command. When the workflow completes, the controller creates the artifact-GC pod with the injected patch, giving the attacker a privileged container on a cluster node for host filesystem access and lateral movement. No public POC or KEV entry is referenced, though the fix commit is public.