CVE-2026-93991

HighCVSS 7.7/10Last modified Sep 22, 2026

Description

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 19, 2026
Last modified: Sep 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-939928.1Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files out CVE-2026-939938.8Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before tr CVE-2026-939948.1Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication scheme CVE-2026-939956.5Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java libra CVE-2026-939966.5Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD i CVE-2026-939977.3A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the CVE-2026-939994.2A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs d CVE-2026-94006.3A flaw has been found in Edimax BR-6675nD 1.12. This issue affects the function formUSBStorage of the file /goform/formUSBStorage of the com CVE-2026-940006.6A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-me CVE-2026-940016.5A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting u CVE-2026-940027.5Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0 CVE-2026-9400310.0A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config o