Argo Workflows versions 3.6.5 through 4.0.4 and 3.7.0 through 3.7.13 contain an unchecked array index vulnerability (CWE-129) in the podGCFromPod() function of the pod informer. A malformed pod annotation triggers a panic outside the controller's recover scope, crashing the controller process. Because the poisoned pod remains after restart, the controller repeatedly crashes, causing a denial of service for workflow orchestration. The vulnerability is resolved in versions 4.0.5 and 3.7.14.

This vulnerability causes a denial of service by crashing the argo-workflows controller process when it encounters a malformed pod annotation. The crash loop persists until the problematic pod is manually deleted, halting all workflow processing. There is no impact on confidentiality or integrity reported. The CVSS 3.1 score is 7.7 (high), reflecting network attack vector, low complexity, low privileges required, no user interaction, and complete availability impact with scope change.

A fix is available in argo-workflows versions 4.0.5 and 3.7.14. Users should upgrade to one of these versions or later to remediate the vulnerability. Until upgraded, manual deletion of any pods with malformed workflows.argoproj.io/pod-gc-strategy annotations can temporarily restore controller operation. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.