REDHAT-BUG-2446551: High severity Argo Workflows vulnerability
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin-approved templates. The podSpecPatch field on a submitted Workflow takes precedence over the referenced WorkflowTemplate during spec merging and is applied directly to the pod spec at creation time with no security validation. This vulnerability is fixed in 4.0.2 and 3.7.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
argo-workflowsto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
argo-workflowsto a version that resolves this vulnerability.Fixed in 3.7.11
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2446551?
The severity of REDHAT-BUG-2446551 is rated as high (7).
How do I fix REDHAT-BUG-2446551?
To fix REDHAT-BUG-2446551, update Argo Workflows to version 4.0.2 or later.
What versions of Argo Workflows are affected by REDHAT-BUG-2446551?
Argo Workflows versions from 2.9.0 to before 4.0.2 and 3.7.11 are affected by REDHAT-BUG-2446551.
What is the impact of REDHAT-BUG-2446551 on Argo Workflows?
REDHAT-BUG-2446551 allows users to bypass security settings defined in a WorkflowTemplate by using a podSpecPatch field.
Who is affected by REDHAT-BUG-2446551?
Any user who can submit Workflows on an affected version of Argo Workflows is at risk from REDHAT-BUG-2446551.