CVE-2026-93991: Authorization Bypass Through User-Controlled Key in argoproj argo-workflows
Argo Workflows versions 4.1.0 through 4.1.3 have an authorization bypass vulnerability in the ListArchivedWorkflows function. This flaw occurs because the cluster-scoped access review is not enforced when the metadata.namespace field selector uses the NotEquals operator. As a result, attackers with namespace-scoped list permissions can use a negated namespace selector to access archived workflows from other namespaces, exposing sensitive workflow details such as spec arguments, parameter values, and annotations.
AI Analysis
Technical Summary
CVE-2026-93991 is an authorization bypass vulnerability affecting Argo Workflows versions 4.1.0 through 4.1.3. The vulnerability arises in the ListArchivedWorkflows API where the cluster-scoped access review is improperly applied when the metadata.namespace field selector uses the NotEquals operator. This allows an attacker who has namespace-scoped list permissions to craft a negated namespace selector to retrieve archived workflows from all other namespaces, thereby exposing sensitive workflow metadata including spec arguments, parameter values, and annotations.
Potential Impact
An attacker with namespace-scoped list permissions can bypass intended access controls to view archived workflows in other namespaces. This exposure includes potentially sensitive workflow specifications, parameters, and annotations, which could lead to information disclosure and aid further attacks or reconnaissance within the cluster.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict namespace-scoped list permissions to trusted users only and monitor for suspicious use of negated namespace selectors in ListArchivedWorkflows API calls.
CVE-2026-93991: Authorization Bypass Through User-Controlled Key in argoproj argo-workflows
Description
Argo Workflows versions 4.1.0 through 4.1.3 have an authorization bypass vulnerability in the ListArchivedWorkflows function. This flaw occurs because the cluster-scoped access review is not enforced when the metadata.namespace field selector uses the NotEquals operator. As a result, attackers with namespace-scoped list permissions can use a negated namespace selector to access archived workflows from other namespaces, exposing sensitive workflow details such as spec arguments, parameter values, and annotations.
CVSS v4.0
Score 8.3high
Affected software
argoproj
argo-workflows
pkg:github/argo-workflowsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-93991 is an authorization bypass vulnerability affecting Argo Workflows versions 4.1.0 through 4.1.3. The vulnerability arises in the ListArchivedWorkflows API where the cluster-scoped access review is improperly applied when the metadata.namespace field selector uses the NotEquals operator. This allows an attacker who has namespace-scoped list permissions to craft a negated namespace selector to retrieve archived workflows from all other namespaces, thereby exposing sensitive workflow metadata including spec arguments, parameter values, and annotations.
Potential Impact
An attacker with namespace-scoped list permissions can bypass intended access controls to view archived workflows in other namespaces. This exposure includes potentially sensitive workflow specifications, parameters, and annotations, which could lead to information disclosure and aid further attacks or reconnaissance within the cluster.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict namespace-scoped list permissions to trusted users only and monitor for suspicious use of negated namespace selectors in ListArchivedWorkflows API calls.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-19T12:04:52.547Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aaf341655bf5e2cf5588792
Added to database: 09/20/2026, 01:17:10 UTC
Last enriched: 09/20/2026, 01:31:37 UTC
Last updated: 09/20/2026, 02:58:05 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.