CVE-2026-42297

HighCVSS 8.3/10Last modified Jul 24, 2026

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-862CWE-425

Affected software

VendorProductVersions
argoprojargo-workflows>= 4.0.0, < 4.0.5
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—

References

Timeline

Published
May 9, 2026
Last modified
Jul 24, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-422989.8Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker ImagCVE-2026-42306.3A vulnerability has been found in vanna-ai vanna up to 2.0.2. Affected is the function update_sql of the file src/vanna/legacy/flask/__init_CVE-2026-423009.3DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-suppliCVE-2026-423017.8pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.CVE-2026-423029.8FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerabCVE-2026-423036.1Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity veriCVE-2026-423047.5Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulneCVE-2026-423058.8Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbiCVE-2026-423067.2Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby DaemCVE-2026-423074.4Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standaCVE-2026-423085.5Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeCVE-2026-423095.5Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept co