Vulnerability · Published May 9, 2026 · Assigned by GitHub_M
CVE-2026-42183Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Low 2.3
In plain English
A low-severity null pointer dereference in argo-workflows from argoproj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/argoproj/argo-workflows | no fix listed | GO-2026-5527 |
| Go | github.com/argoproj/argo-workflows/v2 | no fix listed | GO-2026-5527 |
| Go | github.com/argoproj/argo-workflows/v3 | no fix listed | GO-2026-5527 |
| Go | github.com/argoproj/argo-workflows/v4 | 4.0.5 | GHSA-p4gq-3vxj-f4jq |
| Go | github.com/argoproj/argo-workflows/v4 | 4.0.5 | GO-2026-5527 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| argoproj | argo-workflows | >= 4.0.0, < 4.0.5 |
Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N