REDHAT-BUG-2461236: High severity Argo Argo Workflows vulnerability
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Argo Workflows controllerto a version that resolves this vulnerability.Fixed in 4.0.5 - Upgrade
Upgrade
Argo Workflows controllerto a version that resolves this vulnerability.Fixed in 3.7.14 - Remove
Remove
Kubernetes workflow pod with malformed workflows.argoproj.io/pod-gc-strategy annotationfrom your environment.Manually delete the poisoned workflow pod that persists across restarts; this is required to break the controller crash loop until the malformed pod is removed.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2461236?
The severity of REDHAT-BUG-2461236 is classified as high with a score of 7.
What type of software is affected by REDHAT-BUG-2461236?
REDHAT-BUG-2461236 affects Argo Workflows, which is an open source container-native workflow engine for Kubernetes.
What causes the vulnerability in REDHAT-BUG-2461236?
The vulnerability in REDHAT-BUG-2461236 is caused by an unchecked array index in the podGCFromPod() function, leading to a controller-wide panic.
How do I fix REDHAT-BUG-2461236?
To fix REDHAT-BUG-2461236, update Argo Workflows to version 4.0.5 or higher, where the issue has been resolved.
Which versions of Argo Workflows are affected by REDHAT-BUG-2461236?
REDHAT-BUG-2461236 affects Argo Workflows versions from 3.6.5 to 4.0.4.