CVE-2026-42183

Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

Published May 9, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.

Analysis

Technical impact

The vulnerability is a nil pointer dereference (CWE-476) in the rbacAuthorization function of the gateway server for Argo Workflows. When an SSO user’s claims match a namespace-level RBAC rule but do not match an SSO-namespace rule, and the SSO_DELEGATE_RBAC_TO_NAMESPACE setting is true, the server panics. This leads to a denial of service for that user, causing request handling to fail until the controller restarts. The impact is limited to loss of service for affected users; it does not allow code execution or data exfiltration.

Affected Systems

The fault affects argoproj’s Argo Workflows, version 4.0.0 through the release immediately preceding 4.0.5. The patch that fixes the issue is published in version 4.0.5 and later releases.

Risk and Exploitability

The CVSS base score of 2.3 signals low severity, and no EPSS data or KEV listing indicates a low likelihood of abuse. Exploitation requires interaction with SSO authentication to trigger the panic, so it is a user-dependent denial of service. While the risk is modest, patching removes the cause of the server crash.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

argoproj

argo-workflows

affected

Version	Status	Constraints
`>= 4.0.0, < 4.0.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*

No data.

Vendor Product Versions

Argoproj

Argo-workflows

Version	Status	Scheme	Platform
`[4.0.0,4.0.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Argo Workflows 4.0.5 or later to apply the fix for the nil pointer dereference.
If upgrading cannot occur immediately, set the environment variable SSO_DELEGATE_RBAC_TO_NAMESPACE to false to avoid the failing code path.
Review and adjust RBAC rules so that namespace-level rules do not conflict with SSO-namespace rules, reducing the recurrence of panics.

Generated by OpenCVE AI on May 9, 2026 at 05:51 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-p4gq-3vxj-f4jq	Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.377% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/argoproj/argo-workflows/commit/c4cc17d0c034fa9a9cc01ef1af6c8016c93071d4
https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p4gq-3vxj-f4jq
https://nvd.nist.gov/vuln/detail/CVE-2026-42183
https://www.cve.org/CVERecord?id=CVE-2026-42183

History

May 19, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-42183 https://www.cve.org/CVERecord?id=CVE-2026-42183
Metrics	threat_severity `None`	threat_severity `Moderate`

May 14, 2026 6:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Argoproj argo Workflows
CPEs		cpe:2.3:a:argoproj:argo_workflows::::::go::*
Vendors & Products		Argoproj argo Workflows
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

May 13, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 9, 2026 5:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Argoproj Argoproj argo-workflows
Vendors & Products		Argoproj Argoproj argo-workflows

May 9, 2026 4:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.
Title		Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Weaknesses		CWE-476
References		https://github.com/argoproj/argo-workflows/commit/c4cc17d0c034fa9a9cc01ef1af6c8016c93071d4 https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p4gq-3vxj-f4jq
Metrics		cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`