CVE-2026-93991
7.7 HIGHpublic exploit availablePublished 2026-09-19 · Updated 2026-09-22
AI risk analysis
- Summary
- The flaw allows attackers with namespace-scoped list permissions to bypass authorization and retrieve archived workflows from all other namespaces, exposing sensitive information.
- Exploitability
- Exploitation requires attackers to have namespace-scoped list permissions and use a specific field selector with the NotEquals operator. This is moderately hard to exploit.
- Blast radius
- If exploited, this could result in unauthorized access to sensitive workflow details across multiple namespaces, impacting data confidentiality.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Argo Workflows 4.1.4 or later.
auth-bypassinfo-leakworkflows
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-639
Public exploit & PoC references
References
- https://github.com/argoproj/argo-workflows
- https://github.com/argoproj/argo-workflows/commit/a40972386c097ddf816d2e60e13f058bedca53d9
- https://github.com/argoproj/argo-workflows/releases/tag/v4.1.4
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-q65w-j2vp-47c4
- https://www.vulncheck.com/advisories/argo-workflows-4.1.0-through-4.1.3-cross-namespace-disclosure-via-negated-selector
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.