Argo Workflows CVE-2026-31892 Incomplete Fix: Strict/Secure Mode Bypass via hostNetwork

Vulnerability Summary: CVE-2026-31892 Vulnerability Overview Title: Incomplete fix for CVE-2026-31892: , , bypass Strict/Secure Description: This is a supplementary report to the incomplete fix for CVE-2026-31892. The previous fix (commit ) prevented from taking effect in mode; however, it did not prevent other fields (such as , , and ) from being applied to the Pod through the same merging path. Exploitation Method: Users can directly set , override , or modify when creating a Workflow. These fields have higher priority during the merge process than the template. Because the function only checks for , these fields bypass the restrictions and are applied directly to the Pod. Impact: Strict Mode: Users can gain host network access, switch service accounts (enabling SA token mounting), and modify the security context. Secure Mode: Fields overwritten by users are merged into the Pod specification, causing subsequent comparison logic to fail. Actual Impact: This bypasses the restrictions imposed by Argo's Strict/Secure modes, potentially allowing containers to acquire host network permissions, escalate privileges, or mount sensitive service account tokens. Scope of Impact Affected Versions: - - Fixed Versions: - - Prerequisites: Versions supporting the feature (including v4.0.2, v3.7.11, etc.). Remediation Official Fix: Upgrade to version or and above. Temporary Mitigation: - Deploy PodSecurity admission policies or OPA/Gatekeeper policies at the cluster level to independently block high-risk fields such as . - Clusters relying primarily on Argo's Strict mode as their defense layer should strengthen Kubernetes-level controls as an additional measure. POC / Reproduction Code 1. Enable Strict Mode 2. Create Template (including network interface check) 3. Submit a Workflow with 4. Verify the Pod has obtained host network access 5. Verify Bypass 6. Comparison: is still blocked

Goal Reached Thanks to every supporter — we hit 100%!

Argo Workflows CVE-2026-31892 Incomplete Fix: Strict/Secure Mode Bypass via hostNetwork

More from this source