Log in Start free

Vulnerability · Published May 9, 2026 · Assigned by GitHub_M

CVE-2026-42297Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

High 8.3

In plain English

A high-severity missing authorization in argo-workflows from argoproj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/argoproj/argo-workflowsno fix listedGO-2026-5751
Gogithub.com/argoproj/argo-workflows/v2no fix listedGO-2026-5751
Gogithub.com/argoproj/argo-workflows/v3no fix listedGO-2026-5751
Gogithub.com/argoproj/argo-workflows/v44.0.5GHSA-xchc-cqwg-g76q
Gogithub.com/argoproj/argo-workflows/v44.0.5GO-2026-5751

Affected products (as reported)

VendorProductVersions
argoproj argo-workflows >= 4.0.0, < 4.0.5

Weakness: CWE-862, CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

References