CVSS 4.0
2.3 lowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NCVE-2026-42183
Low (2.3) in argoproj argo workflows. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/argoproj/argo-workflows/v4 4.0.5.
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
- CWE
- CWE-476
- Published
- Modified
- Record from
- the NVD, synced
Affected
- argoproj:argo_workflows
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p4gq-3vxj-f4jq | Go | github.com/argoproj/argo-workflows/v4 | >=4.0.0 <4.0.5 | 4.0.5 |
| GO-2026-5527 | Go | github.com/argoproj/argo-workflows | all versions | no fix published |
| GO-2026-5527 | Go | github.com/argoproj/argo-workflows/v2 | all versions | no fix published |
| GO-2026-5527 | Go | github.com/argoproj/argo-workflows/v3 | all versions | no fix published |
| GO-2026-5527 | Go | github.com/argoproj/argo-workflows/v4 | >=4.0.0 <4.0.5 | 4.0.5 |