Argo Workflows ArtifactGC PodSpecPatch Bypass Enables Privilege Escalation

Argo Workflows patched CVE-2026-54526, a privilege-escalation flaw that lets a user bypass Strict and Secure workflowTemplateRef protections through the allow-listed WorkflowSpec.ArtifactGC field. The issue stems from an incomplete fix for CVE-2026-31892: validation only checked top-level WorkflowSpec fields, while nested ArtifactGC settings such as podSpecPatch, serviceAccountName, and podMetadata could still reach the artifact garbage-collection pod unsanitized. In affected deployments, an attacker able to submit a Workflow referencing a hardened WorkflowTemplate could inject a strategic merge patch into the artifact-GC pod when output artifacts and OnWorkflowCompletion cleanup were in use.