CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Authenticated users can bypass authorization to create, read, update, or delete Kubernetes ConfigMaps in Argo Workflows.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42297?
CVE-2026-42297 is a high-severity missing authorization vulnerability in argoproj argo-workflows, published on 9 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.
Which versions are affected by CVE-2026-42297?
7 open source packages ship an affected version, including github.com/argoproj/argo-workflows/v4, argo-workflows and github.com/argoproj/argo-workflows. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows/v4 Go | From 4.0.0 | 4.0.5 |
argo-workflows Bitnami | From 4.0.0 | 4.0.5 |
github.com/argoproj/argo-workflows Go | All versions | None |
github.com/argoproj/argo-workflows/v2 Go | All versions | None |
1 more packages
github.com/argoproj/argo-workflows/v3 Go | All versions | None |
Products include Argoproj Argo Workflows.
How do I fix CVE-2026-42297?
Upgrade github.com/argoproj/argo-workflows/v4 to 4.0.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-42297 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42297 exists.
Other vulnerabilities in argoproj argo-workflows
- CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template
- CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
- CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
- CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials
- CVE-2025-62157 Argo Workflows exposes artifact repository credentials in workflow-controller logs
Sources
Also known as BIT-argo-workflows-2026-42297, GHSA-xchc-cqwg-g76q, GO-2026-5751, MINI-38h2-2289-xq7x, MINI-4526-5rf6-q3hm, MINI-5mpm-qhqg-84hg and 9 more.