CVE-2026-42297 is a missing authorization vulnerability (CWE-862) in the Sync Service ConfigMap-backed provider of Argo Workflows from version 4.0.0 to before 4.0.5. The service performs zero authorization checks on all CRUD operations on Kubernetes ConfigMaps containing synchronization limits. This allows any authenticated user, even those using fake Bearer tokens, to manipulate these ConfigMaps. The vulnerability has been addressed and patched in version 4.0.5.

Exploitation of this vulnerability allows any authenticated user to create, read, update, and delete critical Kubernetes ConfigMaps related to synchronization limits in Argo Workflows. This could lead to unauthorized modification of workflow synchronization behavior, potentially disrupting workflow orchestration or causing denial of service conditions. The CVSS 4.0 score is 8.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in Argo Workflows version 4.0.5. Users should upgrade to version 4.0.5 or later to remediate this vulnerability. The Red Hat advisory linked confirms the patch availability. Until upgraded, restrict access to authenticated users and monitor for unauthorized ConfigMap modifications.