# CVE-2026-42297: Argo Workflows missing authorization in Sync ConfigMap Provider

Source: https://junglewise.ai/threats/cve-2026-42297-argo-workflows-missing-authorization-in-sync-configmap-provider  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-09. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-42297 · Severity: high · CVSS 8.3 · Published 2026-05-09

Argo Workflows, a tool used to manage complex automated tasks on Kubernetes, contains a security flaw in its synchronization service. An attacker with basic access can bypass security checks to create, read, or delete configuration data. This could allow an attacker to shut down automated business processes, disrupt workflows, or access sensitive configuration information.

Technologies: [Argo Project Argo Workflows](https://junglewise.ai/threats/technologies/workflows), [github.com/argoproj/argo-workflows (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows), [github.com/argoproj/argo-workflows/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows-v2), [github.com/argoproj/argo-workflows/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows-v3), [github.com/argoproj/argo-workflows/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-workflows-v4). Vendors: [Argo Project](https://junglewise.ai/threats/vendors/argo-project), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42297 being exploited in the wild.

**How severe is CVE-2026-42297?** High severity, with a CVSS score of 8.3, published 9 May 2026.

**Which products and versions are affected?** Argo Project Argo Workflows >= 4.0.0, < 4.0.5, >=4.0.0, < 4.0.5, 4.0.0 to 4.0.4; github.com/argoproj/argo-workflows (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-workflows/v3 (Go) SEMVER:introduced=0; and 1 more.

**Is there a fix for CVE-2026-42297?** Yes. github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42297 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42297?** Check whether you run Argo Project Argo Workflows, github.com/argoproj/argo-workflows (Go), github.com/argoproj/argo-workflows/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/argoproj/argo-workflows/v4 (Go): upgrade to 4.0.5 or later

  ```sh
  go get github.com/argoproj/argo-workflows/v4@v4.0.5
  ```


## Technical details

The Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) in Argo Workflows fails to implement authorization checks (auth.CanI) for its CRUD operations. When the server is running in 'Server' or 'SSO' mode, it uses its own privileged Kubernetes client identity rather than the user's identity, effectively bypassing RBAC. An attacker with network access and minimal authentication (even using fake Bearer tokens) can create, read, update, or delete Kubernetes ConfigMaps containing synchronization limits. This can lead to a Denial of Service by setting limits to zero, or arbitrary manipulation of ConfigMaps within the namespace accessible to the server's service account. The issue is fixed in version 4.0.5 by adding explicit SelfSubjectAccessReview checks.

## Affected products

- Argo Project Argo Workflows >=4.0.0, < 4.0.5

## Identifiers

- CVE-2026-42297
- GHSA-xchc-cqwg-g76q
- GO-2026-5751

## Timeline

- 2026-04-23: patched: Fix committed and version 4.0.5 released.
- 2026-05-09: advisory: CVE-2026-42297 published.

## References

- [https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6](https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6)
- [https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5](https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5)
- [https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q](https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q)

## Related threats

- [Argo Workflows authorization bypass in ListArchivedWorkflows](https://junglewise.ai/threats/cve-2026-93991-argo-workflows-versions-4-1-0-through-4-1-3-contain-an)
- [Argo Workflows privilege escalation via ArtifactGC PodSpecPatch](https://junglewise.ai/threats/cve-2026-54526-argo-workflows-privilege-escalation-via-artifactgc-podspecpatch)
- [Argo Workflows authorization bypass in templateReferencing Strict mode](https://junglewise.ai/threats/cve-2026-42296-argo-workflows-authorization-bypass-in-templatereferencing-strict)
- [Argo Workflows plaintext credential leak in workflow logs](https://junglewise.ai/threats/cve-2026-42295-argo-workflows-plaintext-credential-leak-in-workflow-logs)
- [Argo Workflows denial of service in Webhook Interceptor](https://junglewise.ai/threats/cve-2026-42294-argo-workflows-denial-of-service-in-webhook-interceptor)