VULNERABILITY INTELLIGENCE
CVE-2026-42297
CVSS score8.3 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-05-09
Last modified2026-07-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.
Weakness classification
- security-advisories@github.com: CWE-862
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-425
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Exploit, Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c