CVE-2026-42296

[CVE catalog]

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Published

May 9, 2026, 3:52:03 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.42% · Oct 25, 2026

A flaw was found in Argo Workflows. A user with create Workflow permission can bypass the `templateReferencing: Strict` security control. This bypass allows the user to gain host network access, switch service accounts, override pod security context, add tolerations to schedule on control-plane nodes, or enable Service Account (SA) token mounting. This could lead to privilege escalation and unauthorized access within the Kubernetes cluster. Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Privilege escalation via security control bypass Severity: Important This issue is classified as Important because a user with create Workflow permission can bypass Argo Workflows templateReferencing Strict or Secure controls and influence pod security posture (hostNetwork, serviceAccountName, securityContext, tolerations, automountServiceAccountToken) when submitting workflows that reference WorkflowTemplates. RH CVSS 8.1 reflects network reachability, low-privilege attacker (workflow submitter), and high confidentiality/integrity impact in the cluster context (PR:L, UI:N). Red Hat OpenShift AI ships Argo Workflows as part of Data Science Pipelines (workflow-controller and argoexec containers, plus related ml-pipelines components) on supported streams rhoai-2.25, rhoai-3.3, and rhoai-3.4. Bundled versions are below the upstream fix (3.7.14). Practical exploitability also depends on Kubernetes-level controls (PodSecurity admission, OPA/Gatekeeper) and namespace RBAC for workflow creation. This CVE is an incomplete fix for CVE-2026-31892; clusters that received the earlier 3.7.11-class update remain affected until upgraded to 3.7.14 or later on the 3.x line. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.