PT-2026-37195 · Unknown · Argo Workflows

Nebojsaj1726 · Published 2026-05-04 · Updated 2026-05-12 · CVE-2026-42297

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.0.0 through 4.0.4

Description The Sync Service's ConfigMap-backed provider in server/sync/sync cm.go lacks authorization checks for all create, read, update, and delete (CRUD) operations. This allows any authenticated user, including those utilizing fake Bearer tokens, to perform these operations on Kubernetes ConfigMaps that store synchronization limits.

Recommendations Update to version 4.0.5.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-ARGO-WORKFLOWS-2026-42297

CVE-2026-42297

GHSA-XCHC-CQWG-G76Q

Affected Products

Argo Workflows

References · 14

• 🔥 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q · Exploit
• https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42297 · Security Note
• https://osv.dev/vulnerability/GHSA-xchc-cqwg-g76q · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-workflows-2026-42297 · Vendor Advisory
• https://github.com/argoproj/argo-workflows · Note
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 · Note
• https://twitter.com/CVEarity/status/2053791294137540925 · Twitter Post
• https://twitter.com/VigneshVic23698/status/2054072284433023256 · Twitter Post
• https://twitter.com/unknownmatter19/status/2053891345992048940 · Twitter Post
• https://t.me/CVEtracker/53203 · Telegram Post
• https://twitter.com/SelvaKtm2/status/2053464099091284225 · Twitter Post
• https://twitter.com/CVEnew/status/2053131391920136665 · Twitter Post
• https://t.me/cveNotify/163168 · Telegram Post