TI-2026-30606 Aliases CVE-2026-42297 GHSA-xchc-cqwg-g76q

Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

HIGH 70CWE-862Published 2026-05-09 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.

Summary

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00515 44th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed argo-workflows (argoproj): 4.0.5github.com/argoproj/argo-workflows/v4 (Go): 4.0.5Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
argoproj	argo-workflows	4.0.0 to before 4.0.5	4.0.5	Patch available	CNA
—	github.com/argoproj/argo-workflows/v4 (Go)	4.0.0 to before 4.0.5	4.0.5	Patch available	GHSA-xchc-cqwg-g76q

argo-workflows Vendorargoproj Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available CNA
github.com/argoproj/argo-workflows/v4 (Go) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-xchc-cqwg-g76q

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:argoproj:argo_workflows::::::go::*	4.0.0 to before 4.0.5	Vulnerable	argoproj

cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:* Versions 4.0.0 to before 4.0.5 Vulnerable ·argoproj

Remediation

Fix · CNA argo-workflows (argoproj) Fixed in 4.0.5
Fix · GHSA-xchc-cqwg-g76q github.com/argoproj/argo-workflows/v4 (Go) Fixed in 4.0.5 Advisory →

Red Hat 1 advisory

RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
RHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift AI 3.3	Fixed	RHSA-2026:73987

Not affected: 2 products

Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift AI 3.3

Timeline

2026-10-02 Threatist record created from CVE-2026-42297
2026-10-03 Alias added: GHSA-xchc-cqwg-g76q
2026-10-07 Fix available: RHSA-2026:73987 · Red Hat

References

Other 2

TI-2026-22564 Argo Workflows has unauthorized access to Argo Workflows Template CVSS 3.1CRITICAL 9.8
TI-2026-30603 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVSS 4.0HIGH 8.2
TI-2026-39371 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing CVSS 4.0HIGH 8.9
TI-2026-24444 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode CVSS 4.0HIGH 8.9
TI-2026-30604 Argo Workflows: Exposure of artifact repository credentials CVSS 4.0HIGH 8.5
TI-2025-38478 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite CVSS 3.1HIGH 8.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences