PT-2026-37195 · Unknown · Argo Workflows

Nebojsaj1726 · CVE-2026-42297 · Published 2026-05-04 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.0.0 through 4.0.4

Description The Sync Service's ConfigMap-backed provider in server/sync/sync cm.go lacks authorization checks for all create, read, update, and delete (CRUD) operations. This allows any authenticated user, including those utilizing fake Bearer tokens, to perform these operations on Kubernetes ConfigMaps that store synchronization limits.

Recommendations Update to version 4.0.5.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-425

CWE-862

Related Identifiers

BIT-ARGO-WORKFLOWS-2026-42297

CVE-2026-42297

GHSA-XCHC-CQWG-G76Q

GO-2026-5751

OPENSUSE-SU-2026:21483-1

Affected Products

Argo Workflows

References · 1755

• 🔥 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42297.json · Exploit
• https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42297 · Security Note
• https://osv.dev/vulnerability/GHSA-xchc-cqwg-g76q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42297 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5751 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-workflows-2026-42297 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 · Note
• https://github.com/argoproj/argo-workflows · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note