CVE-2026-42297: Argo Workflows missing authorization in Sync ConfigMap Provider

CVE-2026-42297 · Severity: high · CVSS 8.3 · Published 2026-05-09

Argo Workflows, a tool used to manage complex automated tasks on Kubernetes, contains a security flaw in its synchronization service. An attacker with basic access can bypass security checks to create, read, or delete configuration data. This could allow an attacker to shut down automated business processes, disrupt workflows, or access sensitive configuration information.

Technologies: Argo Project Argo Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go), github.com/argoproj/argo-workflows/v3 (Go), github.com/argoproj/argo-workflows/v4 (Go). Vendors: Argo Project, Go.

Quick answers

Is CVE-2026-42297 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42297 being exploited in the wild.
How severe is CVE-2026-42297?
High severity, with a CVSS score of 8.3, published 9 May 2026.
Which products and versions are affected?
Argo Project Argo Workflows >= 4.0.0, < 4.0.5, >=4.0.0, < 4.0.5, 4.0.0 to 4.0.4; github.com/argoproj/argo-workflows (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v3 (Go) SEMVER:introduced=0; and 1 more.
Is there a fix for CVE-2026-42297?
Yes. github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42297 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42297?
Check whether you run Argo Project Argo Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later
    go get github.com/argoproj/argo-workflows/v4@v4.0.5

Technical details

The Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) in Argo Workflows fails to implement authorization checks (auth.CanI) for its CRUD operations. When the server is running in 'Server' or 'SSO' mode, it uses its own privileged Kubernetes client identity rather than the user's identity, effectively bypassing RBAC. An attacker with network access and minimal authentication (even using fake Bearer tokens) can create, read, update, or delete Kubernetes ConfigMaps containing synchronization limits. This can lead to a Denial of Service by setting limits to zero, or arbitrary manipulation of ConfigMaps within the namespace accessible to the server's service account. The issue is fixed in version 4.0.5 by adding explicit SelfSubjectAccessReview checks.

Affected products

  • Argo Project Argo Workflows >=4.0.0, < 4.0.5

Identifiers

  • CVE-2026-42297
  • GHSA-xchc-cqwg-g76q
  • GO-2026-5751

Timeline

  • 2026-04-23: patched: Fix committed and version 4.0.5 released.
  • 2026-05-09: advisory: CVE-2026-42297 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.