A critical denial of service vulnerability in Argo Workflows permits authenticated users to crash the controller process, halting all workflow operations until manual intervention occurs.

This flaw involves improper validation of an array index within the podGCFromPod function, which is triggered when a user provides a malformed workflows.argoproj.io/pod-gc-strategy annotation. An authenticated user with sufficient permissions to create or modify workflows can cause the controller to enter a crash loop that persists across restarts.

Successful exploitation results in a complete, persistent denial of service for the Argo Workflows controller. Given the CVSS score of 7.7, the impact on availability is high, as it prevents the orchestration of all parallel jobs and automated workflows. This disruption can lead to significant operational downtime for containerized environments relying on Argo for CI/CD or data processing pipelines.

Immediate Action: Upgrade to Argo Workflows version 4.0.5 or 3.7.14, which contain the necessary fixes for the array index validation error.

Proactive Monitoring: Monitor Kubernetes controller logs for repeated panic events or restart loops associated with the podGCFromPod function.

Compensating Controls: Implement strict role-based access control (RBAC) policies to limit which users can define or modify workflow annotations, thereby reducing the attack surface.

Public Exploit Available: Unknown.

Organizations utilizing Argo Workflows must prioritize patching to the identified secure versions immediately. Since the vulnerability allows for a persistent denial of service that requires manual deletion of the malicious pod to recover, the risk of operational impact is severe for production environments. Applying the update is the only effective way to prevent unauthorized users from forcing a controller crash loop.