Argo Workflows Helm chart (argo-helm, workflow-role RBAC): The chart's workflow-role grants create on pods/exec to

Impact

The chart's workflow-role grants create on pods/exec to every workflow pod, which since Argo 3.4 and the Emissary executor is no longer needed. Any workflow can therefore exec into any other pod in the same namespace and run commands there - a tenant who gets a colleague to run a malicious template owns the whole namespace.

Who can reach it

A user who can get a workflow template executed in the namespace. Requires the argo-workflows Helm chart below 0.44.0 with appVersion 3.4 or above; upstream plain manifests are not affected.

What to do

Upgrade the argo-workflows Helm chart to 0.44.0 or later and apply it. This is an RBAC Role change, so it takes effect on apply without restarting the controller. If you templated the chart into your own manifests, strip pods/exec from workflow-role directly.

References