Cpe:2.3:a:argoproj:argo_workflows:4.1.1:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aargoprojargo_workflows4.1.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 20 Sep 2026 00:15:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in Argo Workflows ListArchivedWorkflowshttps://feed.craftedsignal.io/briefs/2026-09-argo-workflows-auth-bypass/Sun, 20 Sep 2026 00:15:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-argo-workflows-auth-bypass/Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows allowing unauthorized access to workflow metadata via crafted namespace field selectors.Argo Workflows versions 4.1.0 through 4.1.3 are affected by an authorization bypass vulnerability (CVE-2026-93991) within the ListArchivedWorkflows function. The vulnerability stems from an inadequate application of cluster-scoped access reviews when users provide specific field selectors during an API request. Specifically, when a request includes a metadata.namespace field selector utilizing the NotEquals operator, the system fails to restrict the result set to the user's authorized namespace. This flaw allows an authenticated attacker possessing only namespace-scoped list permissions to successfully perform unauthorized data exfiltration. Impacted organizations may see exposure of sensitive information stored in archived workflows, including spec arguments, parameter values, and metadata annotations from namespaces they do not legitimately manage.

Impact

Successful exploitation leads to unauthorized information disclosure of workflow configurations across a Kubernetes cluster. This can expose sensitive secrets, environment-specific parameters, and architectural details contained within workflow specs that should be protected by RBAC, potentially aiding in further lateral movement or privilege escalation within the cloud environment.

Recommendation

  1. Upgrade Argo Workflows to the latest patched version immediately.
  2. Audit Kubernetes RBAC policies to ensure minimal list permissions are applied to namespace-scoped service accounts.
  3. Review API access logs for anomalous usage of metadata.namespace field selectors with negation operators.
]]>highadvisoryvulnerabilitycloudauthorization-bypass