The vulnerability stems from incomplete validation in the allow-list for user overrides in argo-workflows. Specifically, the WorkflowSpec.ArtifactGC field is allow-listed wholesale, including its PodSpecPatch sub-field, which is passed unmodified to a strategic merge patch function applied to the artifact garbage collection pod. This allows a user submitting a Workflow under strict or secure template referencing modes to inject arbitrary pod specification patches, including privileged settings and host network access, circumventing intended security restrictions. The flaw exists because the validation only inspects top-level fields and does not recursively validate sub-fields like PodSpecPatch within ArtifactGC. The vulnerability requires the referenced WorkflowTemplate to have at least one template with an output artifact and the user to specify an artifactGC strategy that triggers the patch application. The affected versions are all releases before 3.7.15 and 4.0.6. The CVSS 4.0 score is 8.9, reflecting high impact with network attack vector, low attack complexity, and partial privileges required.

Exploitation allows a user with limited privileges to escalate access by injecting arbitrary pod specification patches into the artifact garbage collection pod. This can enable privileged container execution, host network access, arbitrary images and commands, and override hardened security contexts. The vulnerability defeats the security intent of strict or secure template referencing modes, potentially compromising cluster security and workload isolation.

A patch is available for this vulnerability. Users should upgrade argo-workflows to version 3.7.15 or later, or 4.0.6 or later, where this issue is fixed. Until patched, avoid using allow-listed ArtifactGC.PodSpecPatch fields or restrict workflow submissions to trusted users. There is no indication from the vendor advisory that any other mitigations or workarounds are sufficient.