CVE-2026-42297CWE-862

Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

High · published May 9, 2026

CVSS v4.0
8.5
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H
EPSS
0.00526 · 43.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-09T03:42Z
EPSS history
Timeline
  • 09 MAY 03:42Z
    Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
    cvelistv5