Log in Start free

Vulnerability · Published May 9, 2026 · Assigned by GitHub_M

CVE-2026-42294Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

High 7.5

In plain English

A high-severity resource allocation without limits in argo-workflows from argoproj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the /api/v1/events/ endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service. This issue has been patched in versions 3.7.14 and 4.0.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/argoproj/argo-workflowsno fix listedGO-2026-5462
Gogithub.com/argoproj/argo-workflows/v2no fix listedGO-2026-5462
Gogithub.com/argoproj/argo-workflows/v33.7.14GHSA-jcc8-g2q4-9fxq
Gogithub.com/argoproj/argo-workflows/v33.7.14GO-2026-5462
Gogithub.com/argoproj/argo-workflows/v44.0.5GHSA-jcc8-g2q4-9fxq
Gogithub.com/argoproj/argo-workflows/v44.0.5GO-2026-5462

Affected products (as reported)

VendorProductVersions
argoproj argo-workflows < 3.7.14>= 4.0.0, < 4.0.5

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References