CVE-2026-42297: argoproj argo_workflows Missing Authorization
Vulnerability summary
CVE-2026-42297 is a high (CVSS 8.5) Missing Authorization vulnerability in argoproj argo_workflows. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated8.5HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H
- OSV · GoEcosystem advisory · calculated8.5HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated8.5HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H
- NVDNIST8.5HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.01 pp
From 0.52% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundArgo Workflows
Maturity: poc
Weaknesses
CWE · root cause- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Affected systems
Chainguard21 products
- argo-workflow-controller-3.6< 3.6.19-r6
- argo-workflow-controller-3.7< 3.7.15-r2
- argo-workflow-controller-fips-3.6< 3.6.19-r10
- argo-workflow-controller-fips-3.7< 3.7.15-r3
- argo-workflow-executor-3.6< 3.6.19-r6
Wolfi8 products
- argo-workflow-controller-3.7< 3.7.15-r2
- argo-workflow-executor-3.7< 3.7.15-r2
- argo-workflows-3.7< 3.7.15-r2
- kubeflow-pipelines-apiserver< 2.16.1-r15 | < 2.17.2-r4
- kubeflow-pipelines-cache_server< 2.16.1-r15
Github.com/argoproj/argo-workflows3 products
- v2All versions (No fix recorded)
- v3All versions (No fix recorded)
- v4≥ 4.0.0, < 4.0.5
Argoproj2 products
- argo_workflows≥ 4.0.0, < 4.0.5
- argo-workflows≥ 4.0.0, < 4.0.5
Github.com/argoproj1 product
- argo-workflowsAll versions (No fix recorded)
5 vendors · 35 products
References
9 links- github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76qX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6X Refsource MISCFIXWEBPatch
