# CVE-2026-42183: Argo Workflows denial of service via nil pointer dereference in gatekeeper

Source: https://junglewise.ai/threats/cve-2026-42183-argo-workflows-denial-of-service-via-nil-pointer-dereference-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-09. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-42183 · Severity: medium · CVSS 6.5 · Published 2026-05-09

Argo Workflows is an automation engine used to manage complex computing tasks on Kubernetes. A flaw in how the system handles user permissions for Single Sign-On (SSO) users can cause the server to crash when processing certain requests. This results in a denial of service, preventing affected users from accessing the platform or managing their workflows.

Technologies: [Argo Project Argo Workflows](https://junglewise.ai/threats/technologies/workflows), [github.com/argoproj/argo-workflows (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows), [github.com/argoproj/argo-workflows/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows-v2), [github.com/argoproj/argo-workflows/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows-v3), [github.com/argoproj/argo-workflows/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows-v4). Vendors: [Argo Project](https://junglewise.ai/threats/vendors/argo-project), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42183 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42183 being exploited in the wild.

**How severe is CVE-2026-42183?** Medium severity, with a CVSS score of 6.5, published 9 May 2026.

**Which products and versions are affected?** Argo Project Argo Workflows >= 4.0.0, <= 4.0.4, 4.0.0 to 4.0.4; Argo Project Workflows >= 4.0.0, < 4.0.5; github.com/argoproj/argo-workflows (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v2 (Go) SEMVER:introduced=0; and 2 more.

**Is there a fix for CVE-2026-42183?** Yes. github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42183 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42183?** Check whether you run Argo Project Argo Workflows, Argo Project Workflows, github.com/argoproj/argo-workflows (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later

  ```sh
  go get github.com/argoproj/argo-workflows/v4@v4.0.5
  ```


## Technical details

A nil pointer dereference exists in `server/auth/gatekeeper.go` within the `rbacAuthorization()` function. When `SSO_DELEGATE_RBAC_TO_NAMESPACE=true` is configured, the system attempts to compare RBAC rule precedence between a namespace-level account and an SSO-level account. If a user's claims match a namespace-level rule but no SSO-namespace rule exists, the `loginAccount` variable remains nil, causing a panic when passed to the `precedence()` function which attempts to access its annotations. While the gRPC recovery interceptor prevents a full process crash, affected users receive HTTP 500 errors for all subsequent API requests, effectively resulting in a persistent denial of service for those identities. This issue is fixed in version 4.0.5.

## Affected products

- argoproj Argo Workflows >= 4.0.0, < 4.0.5

## Identifiers

- CVE-2026-42183
- GHSA-p4gq-3vxj-f4jq
- GO-2026-5527

## Timeline

- 2026-04-17: other: Vulnerability confirmed via PoC testing
- 2026-04-23: patched: Version 4.0.5 released
- 2026-05-09: disclosed: Advisory published

## References

- [https://github.com/argoproj/argo-workflows/commit/c4cc17d0c034fa9a9cc01ef1af6c8016c93071d4](https://github.com/argoproj/argo-workflows/commit/c4cc17d0c034fa9a9cc01ef1af6c8016c93071d4)
- [https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5](https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5)
- [https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p4gq-3vxj-f4jq](https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p4gq-3vxj-f4jq)

## Related threats

- [Argo Workflows authorization bypass in ListArchivedWorkflows](https://junglewise.ai/threats/cve-2026-93991-argo-workflows-versions-4-1-0-through-4-1-3-contain-an)
- [Argo Workflows privilege escalation via ArtifactGC PodSpecPatch](https://junglewise.ai/threats/cve-2026-54526-argo-workflows-privilege-escalation-via-artifactgc-podspecpatch)
- [Argo Workflows missing authorization in Sync ConfigMap Provider](https://junglewise.ai/threats/cve-2026-42297-argo-workflows-missing-authorization-in-sync-configmap-provider)
- [Argo Workflows authorization bypass in templateReferencing Strict mode](https://junglewise.ai/threats/cve-2026-42296-argo-workflows-authorization-bypass-in-templatereferencing-strict)
- [Argo Workflows plaintext credential leak in workflow logs](https://junglewise.ai/threats/cve-2026-42295-argo-workflows-plaintext-credential-leak-in-workflow-logs)