CVE-2026-42183: falha de baixa gravidade em argoproj argo-workflows
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Publicada em · Atualizada em
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3epss 0.6%
probabilidade de exploração
0.6%top 54% das CVEs
exploração observada
nãonenhuma fonte reporta
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
argoproj · argo-workflowsCVEs relacionadas — argoproj argo-workflows
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29164HIGHPrivilege Escalation in argo-workflowsEPSS 0.9%CVE-2026-28229CRITICALArgo Workflows has unauthorized access to Argo Workflows TemplateEPSS 0.8%CVE-2026-42294HIGHArgo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorEPSS 0.7%CVE-2025-66626HIGHargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic linksEPSS 0.7%CVE-2024-53862MEDIUMArgo Workflows Allows Access to Archived Workflows with Fake Token in `client` modeEPSS 0.7%CVE-2026-31892HIGHWorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference ModeEPSS 0.7%