Skip to content
Advisories.
argo-workflowsGO-2026-5527

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows

Medium6.5CVE-2026-42183 · Published Jun 25, 2026 · updated Jul 2, 2026

Source advisory

Affected versions

PackageAffectedFixed in
github.com/argoproj/argo-workflows
Go
all versionsNo fix yet

Changes since it was listed

DateChange
Sep 25Severity: Unrated to Medium
Details and references

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from
NVD
Also known as
BIT-argo-workflows-2026-42183, CVE-2026-42183, GHSA-p4gq-3vxj-f4jq

More argo-workflows advisories

All
DateAdvisory
Jun 25Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows
CVE-2026-42296High8.1no fix yet
Jun 25Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows
CVE-2026-40886Unratedno fix yet
Jun 25Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows
CVE-2026-42295Medium4.9no fix yet
Jun 25Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows
CVE-2026-42294High7.5no fix yet
Jun 25Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows
CVE-2026-42297High8.3no fix yet
Aug 13Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
CVE-2026-54526Highno fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.