Executive brief
Argo Workflows is an automation engine used to manage complex computing tasks on Kubernetes. A flaw in how the system handles user permissions for Single Sign-On (SSO) users can cause the server to crash when processing certain requests. This results in a denial of service, preventing affected users from accessing the platform or managing their workflows.
Technical details
A nil pointer dereference exists in `server/auth/gatekeeper.go` within the `rbacAuthorization()` function. When `SSO_DELEGATE_RBAC_TO_NAMESPACE=true` is configured, the system attempts to compare RBAC rule precedence between a namespace-level account and an SSO-level account. If a user's claims match a namespace-level rule but no SSO-namespace rule exists, the `loginAccount` variable remains nil, causing a panic when passed to the `precedence()` function which attempts to access its annotations. While the gRPC recovery interceptor prevents a full process crash, affected users receive HTTP 500 errors for all subsequent API requests, effectively resulting in a persistent denial of service for those identities. This issue is fixed in version 4.0.5.
Affected products
- argoproj Argo Workflows >= 4.0.0, < 4.0.5
Timeline
- 2026-04-17: other: Vulnerability confirmed via PoC testing
- 2026-04-23: patched: Version 4.0.5 released
- 2026-05-09: disclosed: Advisory published