CVE-2026-42294: Argo Workflows denial of service in Webhook Interceptor

Executive brief

Argo Workflows is an open-source engine for orchestrating parallel jobs on Kubernetes. A vulnerability in its webhook processing component allows an unauthenticated attacker to crash the Argo Server by sending a specially crafted, large request. This results in a denial of service, preventing users from managing workflows or accessing the API.

Technical details

The vulnerability is an 'Allocation of Resources Without Limits or Throttling' (CWE-770) within the Webhook Interceptor (`server/auth/webhook/interceptor.go`). The `addWebhookAuthorization` function uses `io.ReadAll` to load the entire HTTP request body into memory before performing authentication or signature verification. Because the `/api/v1/events/` endpoint is publicly accessible, a remote, unauthenticated attacker can send a multi-gigabyte payload, triggering an Out-Of-Memory (OOM) crash of the Argo Server. The issue is fixed in versions 3.7.14 and 4.0.5 by implementing request body size limits.

Affected products

• argoproj argo-workflows/v3 < 3.7.14
• argoproj argo-workflows/v4 >= 4.0.0, < 4.0.5

Timeline

• 2026-04-23: disclosed: Initial disclosure to maintainers
• 2026-05-04: advisory: GitHub Advisory published
• 2026-05-09: advisory: NVD published CVE-2026-42294
• 2026-07-21: other: Advisory updated

References

• https://api.github.com/users/Rudra2018
• https://github.com/Rudra2018
• https://api.github.com/users/Rudra2018/gists%7B/gist_id%7D
• https://api.github.com/users/Rudra2018/repos
• https://avatars.githubusercontent.com/u/36075950?v=4
• https://api.github.com/users/Rudra2018/events%7B/privacy%7D