CVE-2026-42297: CWE-862: Missing Authorization in argoproj argo-workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.
AI Analysis
Technical Summary
Argo Workflows, an open source container-native workflow engine for Kubernetes, contains a missing authorization vulnerability (CWE-862) in its Sync Service's ConfigMap-backed provider in versions 4.0.0 up to but not including 4.0.5. The service performs zero authorization checks on all CRUD operations on ConfigMaps that control synchronization limits. This flaw permits any authenticated user, including those using fake Bearer tokens, to create, read, update, or delete these ConfigMaps. The vulnerability has a CVSS 4.0 base score of 8.5 (high severity) and was patched in version 4.0.5. The Red Hat advisory linked confirms the issue and remediation version but does not provide additional mitigation details.
Potential Impact
Exploitation of this vulnerability allows any authenticated user to fully manipulate Kubernetes ConfigMaps related to synchronization limits in Argo Workflows. This could lead to unauthorized modification or deletion of critical configuration data, potentially disrupting workflow orchestration or enabling further privilege escalation within the Kubernetes environment. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
A fix is available in Argo Workflows version 4.0.5. Users should upgrade to version 4.0.5 or later to remediate this vulnerability. The Red Hat advisory confirms the patch availability. No additional mitigations or workarounds are specified in the advisory.
CVE-2026-42297: CWE-862: Missing Authorization in argoproj argo-workflows
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.
CVSS v4.0
Score 8.5high
Affected software
pkg:github/argoproj/argo-workflowsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Argo Workflows, an open source container-native workflow engine for Kubernetes, contains a missing authorization vulnerability (CWE-862) in its Sync Service's ConfigMap-backed provider in versions 4.0.0 up to but not including 4.0.5. The service performs zero authorization checks on all CRUD operations on ConfigMaps that control synchronization limits. This flaw permits any authenticated user, including those using fake Bearer tokens, to create, read, update, or delete these ConfigMaps. The vulnerability has a CVSS 4.0 base score of 8.5 (high severity) and was patched in version 4.0.5. The Red Hat advisory linked confirms the issue and remediation version but does not provide additional mitigation details.
Potential Impact
Exploitation of this vulnerability allows any authenticated user to fully manipulate Kubernetes ConfigMaps related to synchronization limits in Argo Workflows. This could lead to unauthorized modification or deletion of critical configuration data, potentially disrupting workflow orchestration or enabling further privilege escalation within the Kubernetes environment. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
A fix is available in Argo Workflows version 4.0.5. Users should upgrade to version 4.0.5 or later to remediate this vulnerability. The Red Hat advisory confirms the patch availability. No additional mitigations or workarounds are specified in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-26T12:13:55.552Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-42297","vendor":"Red Hat"}]
Threat ID: 69ffe1b2cbff5d8610ead449
Added to database: 05/10/2026, 01:38:58 UTC
Last enriched: 07/15/2026, 13:15:52 UTC
Last updated: 08/16/2026, 12:41:09 UTC
Views: 140
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.