Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod security context, add tolerations to schedule on control-plane nodes, or enable SA token mounting. This defeats the stated purpose of the feature. The practical impact depends on what Kubernetes-level controls are in place. Clusters with PodSecurity admission or OPA/Gatekeeper would independently block some of these (like hostNetwork). Clusters that rely on Argo's Strict mode as the primary enforcement layer are fully exposed. This issue has been patched in versions 3.7.14 and 4.0.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-09 | 2 | Disclosure1General1 |
| 2026-05-11 | 1 | Disclosure1 |
⚡ New CVE Alert: CVE-2026-42296 📊 Severity: 8.1 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-42296 #CVE-2026-42296 #CVE #High #CyberSecurity #InfoSec https://t.co/DnKfWItJye
Post summary
The tweet merely announces the discovery of CVE-2026-42296 and its severity, without offering PoC, exploit, or mitigation information.
CVE-2026-42296 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with creat… https://www.cve.org/CVERecord?id=CVE-2026-42296
Post summary
The message notes CVE-2026-42296 affects Argo Workflows versions prior to 3.7.14 and 4.0.5, but offers no further detail on exploitation, patches, or active use.
CVE-2026-42296 Privilege Escalation in Argo Workflows via templateReferencing Strict Mo... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42296 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces CVE-2026-42296, a privilege escalation flaw in Argo Workflows, and provides links to vulnerability details and a notification, but contains no further technical or exploitation specifics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | argoproj | argo_workflows | - | go | - |