Executive brief
Argo Workflows, a tool used to manage complex automated tasks on Kubernetes, contains a security flaw in its synchronization service. An attacker with basic access can bypass security checks to create, read, or delete configuration data. This could allow an attacker to shut down automated business processes, disrupt workflows, or access sensitive configuration information.
Technical details
The Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) in Argo Workflows fails to implement authorization checks (auth.CanI) for its CRUD operations. When the server is running in 'Server' or 'SSO' mode, it uses its own privileged Kubernetes client identity rather than the user's identity, effectively bypassing RBAC. An attacker with network access and minimal authentication (even using fake Bearer tokens) can create, read, update, or delete Kubernetes ConfigMaps containing synchronization limits. This can lead to a Denial of Service by setting limits to zero, or arbitrary manipulation of ConfigMaps within the namespace accessible to the server's service account. The issue is fixed in version 4.0.5 by adding explicit SelfSubjectAccessReview checks.
Affected products
- Argo Project Argo Workflows >=4.0.0, < 4.0.5
Timeline
- 2026-04-23: patched: Fix committed and version 4.0.5 released.
- 2026-05-09: advisory: CVE-2026-42297 published.