CVE-2026-42183 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Attackers can cause a denial of service in Argo Workflows via a nil pointer dereference when SSO RBAC delegation is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42183?
CVE-2026-42183 is a low-severity vulnerability in argoproj argo-workflows, published on 9 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.
Weakness: CWE-476
Which versions are affected by CVE-2026-42183?
7 open source packages ship an affected version, including github.com/argoproj/argo-workflows/v4, argo-workflows and github.com/argoproj/argo-workflows. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
argo-workflows Bitnami | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows Go | All versions | None |
github.com/argoproj/argo-workflows/v2 Go | All versions | None |
1 more packages
github.com/argoproj/argo-workflows/v3 Go | All versions | None |
Products include Argoproj Argo Workflows.
How do I fix CVE-2026-42183?
Upgrade github.com/argoproj/argo-workflows/v4 to 4.0.5 or later.
Is CVE-2026-42183 being exploited?
There is no known exploitation of CVE-2026-42183 in the wild and no public exploit code.
Other vulnerabilities in argoproj argo-workflows
- CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template
- CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
- CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
- CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials
- CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Sources
Also known as BIT-argo-workflows-2026-42183, GHSA-p4gq-3vxj-f4jq, GO-2026-5527, MINI-2v63-q3mp-7wj3, MINI-756f-4w4r-26f5, MINI-7pqv-pqjw-2h85 and 9 more.