Argo Workflows (controller, hostNetwork / securityContext / serviceAccountName merge path): The first fix for

Impact

The first fix for CVE-2026-31892 gated only on podSpecPatch, leaving hostNetwork, securityContext and serviceAccountName free to flow from the tenant's Workflow through the merge into the pod. Setting hostNetwork true puts a tenant pod on the node's network namespace, and overriding serviceAccountName lets it borrow a more privileged identity - both are direct escapes from the tenant's slice of a shared GPU node.

Who can reach it

Any user who can submit a Workflow that references a hardened template, on a controller running templateReferencing Strict or Secure.

What to do

Upgrade the controller to 3.7.14 or 4.0.5 and restart, then continue to 3.7.15 / 4.0.6 to also cover CVE-2026-54526. Enforce hostNetwork and serviceAccountName restrictions with Pod Security Admission and an admission policy rather than relying on the controller's allow-list.

References

Related entries

• containerd: On SELinux hosts, an unprivileged pod with a hostPath volume can gain full read/write to the host filesystemCVE-2021-43816 · containerdHigh
• Cilium: IPsec transparent encryption is cryptographically ineffectiveCVE-2024-28860 · CiliumHigh
• Nuclio controller: cron trigger headers and body are injected into the CronJob shell commandCVE-2026-52831 · Nuclio controller (cron trigger rendered into Kubernetes CronJob args)High
• Strimzi Cluster Operator: attacker-set watchedNamespace grants Secret read/write in other namespacesCVE-2026-55225 · Strimzi Kafka Operator (Cluster Operator, Kafka.spec.entityOperator.watchedNamespace)High
• Nuclio dashboard: unvalidated function namespace is interpolated into a shell docker ps commandCVE-2026-79755 · Nuclio dashboard (local/Docker platform, function namespace filter)High
• Red Hat Quay quay-builder-qemu: release workflow pins a third-party action to a mutable branchCVE-2026-85469 · Red Hat Quay 3 quay-builder-qemu (GitHub release workflow)High