Argo Workflows, an open source container-native workflow engine for Kubernetes, had a missing authorization vulnerability (CWE-862) in its Sync Service's ConfigMap-backed provider from version 4.0.0 to before 4.0.5. The service allowed any authenticated user to perform all CRUD operations on ConfigMaps controlling synchronization limits without authorization checks. This flaw could enable unauthorized modification or deletion of critical configuration data. The vulnerability is addressed by an official patch in version 4.0.5.

The vulnerability allows any authenticated user, including those using fake Bearer tokens, to create, read, update, and delete Kubernetes ConfigMaps related to synchronization limits in Argo Workflows. This could lead to unauthorized configuration changes affecting workflow synchronization behavior, potentially disrupting operations or enabling further attacks. The CVSS 4.0 score is 8.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An official fix is available in Argo Workflows version 4.0.5. Users should upgrade to version 4.0.5 or later to remediate this vulnerability. No other vendor advisory or patch information is provided, so patching is the recommended mitigation.