CVE-2026-42294: Github.com/argoproj/argo workflows/v3 Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jcc8-g2q4-9fxq",
  "modified" : "2026-07-21T14:54:13Z",
  "published" : "2026-05-04T20:11:01Z",
  "aliases" : [ "CVE-2026-42294" ],
  "summary" : "Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor",
  "details" : "**Severity:** Medium\n**Component:** Webhook Interceptor (`server/auth/webhook`)\n**Vulnerability Type:** Denial of Service (DoS)\n\n## Description\nThe Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the `/api/v1/events/` endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service.\n\n## Vulnerable Code\nIn `server/auth/webhook/interceptor.go`:\n```go\nfunc (i *WebhookInterceptor) addWebhookAuthorization(r *http.Request, kube kubernetes.Interface) error {\n    // ... basic checks ...\n    \n    // Vulnerability: Reads entire body into memory unconditionally\n    buf, _ := io.ReadAll(r.Body)\n    defer func() { r.Body = io.NopCloser(bytes.NewBuffer(buf)) }()\n    \n    // ... subsequent logic finds correct service account and secret ...\n    // ... verification happens later ...\n}\n```\nThe `io.ReadAll` call happens before the signature verification loop.\n\n## Impact\n- **Service Availability:** An attacker can crash the Argo Server, disrupting workflow execution and API access for all users.\n\n## PoC (Conceptual)\n1.  Target the webhook endpoint: `POST /api/v1/events/some-namespace`\n2.  Send a `Content-Length: 1000000000` (1GB) header.\n3.  Stream 1GB of random data.\n4.  Monitor server memory usage. It will spike until 1GB is allocated or the process crashes.\n\n## Recommendation\n1.  **Limit Body Size:** Enforce a strict limit on webhook body size (e.g., 10MB) using `http.MaxBytesReader`.\n2.  **Streaming Verification:** If possible, verify the signature in a streaming fashion or use a temporary file for large payloads (though typically webhooks are small).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-workflows/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.7.14"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-workflows/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.0.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42294"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-42294"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2468443"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/argoproj/argo-workflows"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42294.json"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-04T20:11:01Z",
    "nvd_published_at" : "2026-05-09T04:16:24Z"
  }
}