Argo Workflows, an open source container-native workflow engine for Kubernetes, contains an unchecked array index vulnerability (CWE-129) in the podGCFromPod() function of the pod informer. When a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation, this causes a panic inside an informer goroutine outside the controller's recover scope, crashing the entire controller process. The affected versions are from 3.6.5 up to but excluding 4.0.5 and 3.7.14. The poisoned pod causing the panic persists across controller restarts, resulting in a crash loop that halts all workflow processing until manual deletion of the pod. The vulnerability is fixed in versions 4.0.5 and 3.7.14. The CVSS 3.1 score is 7.7 (high severity) with an impact on availability (A:H) but no confidentiality or integrity impact. No known exploits in the wild have been reported. The vendor advisory from Red Hat confirms the issue and the fixed versions.

The vulnerability causes a denial of service by crashing the entire Argo Workflows controller process when a malformed pod-gc-strategy annotation is present on a workflow pod. This leads to a crash loop that stops all workflow processing until the problematic pod is manually removed. There is no impact on confidentiality or integrity, but availability is severely affected.

A fix is available in Argo Workflows versions 4.0.5 and 3.7.14. Users should upgrade to these versions or later to remediate the vulnerability. Until upgrading, manual deletion of any pods with malformed workflows.argoproj.io/pod-gc-strategy annotations can temporarily mitigate the crash loop. Patch status is confirmed by the vendor advisory from Red Hat.