Argo Workflows Vulnerability in Sync Service by Argo Project

CVE-2026-42297

What is CVE-2026-42297?

Argo Workflows, a prominent open-source container-native workflow engine for Kubernetes, has a vulnerability that affects versions 4.0.0 through 4.0.4. This issue arises from the Sync Service's ConfigMap-backed provider, which performs no authorization checks during CRUD operations. As a result, any authenticated user, even those leveraging counterfeit Bearer tokens, can improperly create, read, update, or delete Kubernetes ConfigMaps linked to synchronization limits. This flaw poses significant risks, as it enables unauthorized manipulation of critical configuration settings. The issue has been addressed in version 4.0.5, and users are encouraged to upgrade to maintain security.

References