CVE-2026-40886

HighCVSS 7.7/10Last modified Oct 26, 2026

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-129CWE-1285

Affected software

VendorProductVersions
argoprojargo-workflows>= 4.0.0, < 4.0.5; >= 3.7.0, < 3.7.14; >= 3.6.5, <= 3.6.19
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—

References

Timeline

Published
Apr 23, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-408879.1Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthentiCVE-2026-408886.5Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with defCVE-2026-408896.5Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can accessCVE-2026-40896.4The Twittee Text Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in all versions upCVE-2026-408907.5The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input cCVE-2026-408915.3OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetCVE-2026-408929.8PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_CVE-2026-408938.2Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:CVE-2026-408945.3OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1CVE-2026-408957.5follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior toCVE-2026-408967.1OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any pCVE-2026-408978.8Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary J