Detections
Analytics

SCA: security update for github.com/argoproj/argo-workflows/v3, github.com/argoproj/argo-workflows/v4 (GHSA-48p8-g2fx-3wwm)

high Tenable Self-Hosted Container Security Plugin ID 445951

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on
 Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because
 workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields
 of WorkflowSpec via reflection, and WorkflowSpec.ArtifactGC is allow-listed wholesale; the struct behind
 that field, WorkflowLevelArtifactGC, has a PodSpecPatch sub-field whose contents flow unmodified into
 util.ApplyPodSpecPatch on the artifact-GC pod, the same sink the original fix closed for
 WorkflowSpec.PodSpecPatch, so a user submitting a Workflow under templateReferencing: Strict or Secure
 (against a referenced WorkflowTemplate that declares an output artifact and setting
 spec.artifactGC.strategy: OnWorkflowCompletion) can still inject an arbitrary strategic merge patch into
 the artifact-GC pod, including hostPath volumes, privileged: true, arbitrary image and command, and
 hostNetwork: true, defeating the stated purpose of Strict/Secure reference mode. This issue is fixed in
 versions 3.7.15 and 4.0.6. (CVE-2026-54526)

Solution

Update the github.com/argoproj/argo-workflows/v3 library and its related packages to version 3.7.15 or later.

See Also

https://github.com/advisories/GHSA-48p8-g2fx-3wwm

Plugin Details

Severity: High

ID: 445951

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/13/2026

Updated: 8/13/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.91

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-54526

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.9

Threat Score: 7.4

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/13/2026

Vulnerability Publication Date: 7/16/2026

Reference Information

CVE: CVE-2026-54526

cwe: CWE-284