access.redhat.comVendor advisory
https://access.redhat.com/errata/RHSA-2026:10184 CVE-2026-31892
HIGH
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Record summary
CVE-2026-31892 has a selected CVSS score of 8.9 (high).
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as a mechanism to restrict users to admin-approved templates. The podSpecPatch field on a submitted Workflow takes precedence over the referenced WorkflowTemplate during spec merging and is applied directly to the pod spec at creation time with no security validation. This vulnerability is fixed in 4.0.2 and 3.7.11.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 11, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 16| Product | Source | Version range | Status |
|---|---|---|---|
Red Hat OpenShift AI (RHOAI)Browse Red Hat / Red Hat OpenShift AI (RHOAI)rhoai/odh-ml-pipelines-api-server-v2-rhel8Default status: unaffected | CVE List | Version data not supplied | |
Red Hat OpenShift AI (RHOAI)Browse Red Hat / Red Hat OpenShift AI (RHOAI)rhoai/odh-ml-pipelines-driver-rhel8Default status: unaffected | CVE List | Version data not supplied | |
Red Hat OpenShift AI (RHOAI)Browse Red Hat / Red Hat OpenShift AI (RHOAI)rhoai/odh-ml-pipelines-launcher-rhel8Default status: unaffected | CVE List | Version data not supplied | |
Red Hat OpenShift AI (RHOAI)Browse Red Hat / Red Hat OpenShift AI (RHOAI)rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8Default status: unaffected | CVE List | Version data not supplied | |
Red Hat OpenShift AI (RHOAI)Browse Red Hat / Red Hat OpenShift AI (RHOAI)rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8Default status: unaffected | CVE List | Version data not supplied | |
Red Hat OpenShift AI 2.25Browse Red Hat / Red Hat OpenShift AI 2.25rhoai/odh-data-science-pipelines-argo-argoexec-rhel9Default status: affected | CVE List | 1776740558 to < * | unaffected |
Red Hat OpenShift AI 2.25Browse Red Hat / Red Hat OpenShift AI 2.25rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9Default status: affected | CVE List | 1776740640 to < * | unaffected |
Red Hat OpenShift AI 2.25Browse Red Hat / Red Hat OpenShift AI 2.25rhoai/odh-ml-pipelines-api-server-v2-rhel9Default status: affected | CVE List | 1776740726 to < * | unaffected |
Red Hat OpenShift AI 2.25Browse Red Hat / Red Hat OpenShift AI 2.25rhoai/odh-ml-pipelines-driver-rhel9Default status: affected | CVE List | 1776740379 to < * | unaffected |
Red Hat OpenShift AI 2.25Browse Red Hat / Red Hat OpenShift AI 2.25rhoai/odh-ml-pipelines-launcher-rhel9Default status: affected | CVE List | 1776740386 to < * | unaffected |
Red Hat OpenShift AI 2.25Browse Red Hat / Red Hat OpenShift AI 2.25rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9Default status: affected | CVE List | 1776740351 to < * | unaffected |
Red Hat OpenShift AI 2.25Browse Red Hat / Red Hat OpenShift AI 2.25rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9Default status: affected | CVE List | 1776740366 to < * | unaffected |
References
7access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-31892 RHBZ#2446551issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2446551 github.com
https://github.com/argoproj/argo-workflows github.comConfirmation
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-3wf5-g532-rcrr nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-31892 security.access.redhat.comx_sadp csaf vex
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31892.json