Authorization Bypass in Argo Workflows ListArchivedWorkflows

Argo Workflows versions 4.1.0 through 4.1.3 are affected by an authorization bypass vulnerability (CVE-2026-93991) within the ListArchivedWorkflows function. The vulnerability stems from an inadequate application of cluster-scoped access reviews when users provide specific field selectors during an API request. Specifically, when a request includes a metadata.namespace field selector utilizing the NotEquals operator, the system fails to restrict the result set to the user's authorized namespace. This flaw allows an authenticated attacker possessing only namespace-scoped list permissions to successfully perform unauthorized data exfiltration. Impacted organizations may see exposure of sensitive information stored in archived workflows, including spec arguments, parameter values, and metadata annotations from namespaces they do not legitimately manage.

Impact

Successful exploitation leads to unauthorized information disclosure of workflow configurations across a Kubernetes cluster. This can expose sensitive secrets, environment-specific parameters, and architectural details contained within workflow specs that should be protected by RBAC, potentially aiding in further lateral movement or privilege escalation within the cloud environment.

Recommendation

1. Upgrade Argo Workflows to the latest patched version immediately.
2. Audit Kubernetes RBAC policies to ensure minimal list permissions are applied to namespace-scoped service accounts.
3. Review API access logs for anomalous usage of metadata.namespace field selectors with negation operators.