A security vulnerability (CVE-2026-54490) affects the argo-workflows package, specifically in the websocket-driver component, which is a WebSocket protocol handler with pluggable I/O. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.