VulnSocial

CVE-2026-42294Disclosure(argoproj / argo_workflows)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch argoproj argo_workflows systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the /api/v1/events/ endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service. This issue has been patched in versions 3.7.14 and 4.0.5.

argoproj CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • argo_workflows

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-05-09); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
argoproj
Products
argo_workflows

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-09: 2Mentions · 2026-05-11: 1Patch / Workaround · 2026-05-09: 1Technical Details · 2026-05-09: 105-0905-11
Signal classification3 categories
Disclosure
133.3%
Patch
133.3%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-092
Disclosure1Patch1
2026-05-111
General1
Full discourse3 posts
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-42294 📊 Severity: 8.2 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-42294 #CVE-2026-42294 #CVE #High #CyberSecurity #InfoSec https://t.co/hCTRYCVYI4

    Post summary

    The tweet merely announces a new CVE with a severity rating and generic product impact, lacking detailed technical info, PoC, or exploitation evidence.

    0000044
    157 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-42294 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Inter… https://www.cve.org/CVERecord?id=CVE-2026-42294

    Post summary

    The note announces CVE-2026-42294 for Argo Workflows and lists patched versions (3.7.14 and 4.0.5), but provides no technical details or exploit information.

    0000057
    57.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-42294 Denial of Service via Memory Exhaustion in Argo Workflows Webhook Interceptor https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42294

    Post summary

    A newly disclosed CVE (2026-42294) details a memory exhaustion DoS in Argo Workflows Webhook Interceptor; the release provides technical information but no PoC, exploit, or patch guidance.

    0000039
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appargoprojargo_workflows-go-

Explore more

Back to dashboardargoproj CVEsargo_workflows vulnerabilities