CVE-2026-42297Disclosure(argoproj / argo_workflows)

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.

argoproj CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-862CWE-425

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

argo_workflows

Threat summary

6 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-05-09); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

argoproj

Products

argo_workflows

Deep dive

Activity timeline6 mentions / 4d

Signal classification2 categories

Disclosure

466.7%

General

233.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-09	2	Disclosure1General1
2026-05-10	1	General1
2026-05-11	2	Disclosure2
2026-05-12	1	Disclosure1

Full discourse6 posts

Vignesh_Pravin@VigneshVic23698150d
Disclosure
CVE-2026-42297: Argo Workflows Auth Bypass Exposes Kubernetes https://thecybrdef.com/cve-2026-42297-argo-workflows-authentication-bypass/ #Cybernews #Cyberupdate #Cybersecuirty
Post summary
A new CVE-2026-42297 vulnerability in Argo Workflows allows authentication bypass, potentially exposing Kubernetes resources.
0000031
2 followersView on X
Harishraam@unknownmatter19150d
Disclosure
CVE-2026-42297: Argo Workflows Auth Bypass Exposes Kubernetes https://thecybrdef.com/cve-2026-42297-argo-workflows-authentication-bypass/ #Cybernews #Cyberupdate #Cybersecuirty
Post summary
Briefly announces the CVE-2026-42297 vulnerability in Argo Workflows (an authentication bypass that exposes Kubernetes), but provides no PoC, exploit, or mitigation details.
0000028
View on X
CVEarity@CVEarity150d
Disclosure
⚡ New CVE Alert: CVE-2026-42297 📊 Severity: 8.5 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-42297 #CVE-2026-42297 #CVE #High #CyberSecurity #InfoSec https://t.co/K1SRphMM6W
Post summary
The tweet simply announces the new CVE-2026-42297 with its severity rating and affected product scope.
0000043
157 followersView on X
selva@SelvaKtm2151d
General
CVE-2026-42297: Argo Workflows Auth Bypass Exposes Kubernetes https://thecybrdef.com/cve-2026-42297-argo-workflows-authentication-bypass/ #Cybernews #Cyberupdate #Cybersecuirty https://t.co/GP10EG3ebC
Post summary
The tweet announces CVE‑2026‑42297, an Argo Workflows authentication bypass, but offers no further technical or operational detail.
0000028
5 followersView on X
CVE@CVEnew152d
General
CVE-2026-42297 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync … https://www.cve.org/CVERecord?id=CVE-2026-42297
Post summary
The text briefly references CVE-2026-42297 affecting Argo Workflows versions 4.0.0 through 4.0.4, with a link to the CVE record, but provides no additional details.
0000064
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds153d
Disclosure
CVE-2026-42297 Unauthorized ConfigMap Operations in Argo Workflows Versions 4.0.0 Through 4.0.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42297
Post summary
A brief notice announcing CVE-2026-42297, describing unauthorized ConfigMap operations in specific Argo Workflow versions, and linking to a vulnerability detail page.
0000042
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	argoproj	argo_workflows	-	go	-

Explore more

Back to dashboard argoproj CVEs argo_workflows vulnerabilities

What researchers are saying

CVE-2026-42297

Vignesh_Pravin@VigneshVic23698Disclosure

A new CVE-2026-42297 vulnerability in Argo Workflows allows authentication bypass, potentially exposing Kubernetes resources.

Harishraam@unknownmatter19Disclosure

Briefly announces the CVE-2026-42297 vulnerability in Argo Workflows (an authentication bypass that exposes Kubernetes), but provides no PoC, exploit, or mitigation details.

CVEarity@CVEarityDisclosure

The tweet simply announces the new CVE-2026-42297 with its severity rating and affected product scope.

selva@SelvaKtm2General

The tweet announces CVE‑2026‑42297, an Argo Workflows authentication bypass, but offers no further technical or operational detail.

CVE@CVEnewGeneral

The text briefly references CVE-2026-42297 affecting Argo Workflows versions 4.0.0 through 4.0.4, with a link to the CVE record, but provides no additional details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A brief notice announcing CVE-2026-42297, describing unauthorized ConfigMap operations in specific Argo Workflow versions, and linking to a vulnerability detail page.