CVE-2026-42294

Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

Published May 9, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the /api/v1/events/ endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service. This issue has been patched in versions 3.7.14 and 4.0.5.

Analysis

Technical impact

Argo Workflows’ Webhook Interceptor reads the entire request body into memory before performing authentication or signature validation. The /api/v1/events endpoint is publicly reachable, and an attacker can send a request with an extremely large body. The unbounded memory allocation can exhaust the Argo Server’s resources, causing an Out‑Of‑Memory crash and resulting in denial of service. This flaw corresponds to CWE‑770: Excessive Resource Consumption.

Affected Systems

The vulnerability affects the open‑source Argo Workflows engine delivered by argoproj. Versions prior to 3.7.14 and 4.0.5 are susceptible; the issue was addressed in the 3.7.14 and 4.0.5 releases.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity, and the vulnerability is not currently listed in the CISA KEV catalog. Because the /api/v1/events endpoint is reachable without authentication, an attacker can trigger the exploit over the public network. There is no EPSS score available, but the potential for resource exhaustion remains significant. The attack vector is a simple HTTP POST to the webhook endpoint with a large payload, which an adversary can conduct from any network location with connectivity to the Argo API.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

argoproj

argo-workflows

affected

Version	Status	Constraints
`< 3.7.14`	affected	—
`>= 4.0.0, < 4.0.5`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:argoproj:argo_workflows::::::go::*
	cpe:2.3:a:argoproj:argo_workflows::::::go::*

No data.

Vendor Product Versions

Argoproj

Argo-workflows

Version	Status	Scheme	Platform
`[0,3.7.14)`	affected	semver	—
`[4.0.0,4.0.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Argo Workflows patch (v3.7.14 or v4.0.5) to remove the vulnerability.
Restrict the /api/v1/events endpoint to trusted IPs or network segments using Ingress or firewall rules to limit access until the patch is in place.
Configure request body size limits in the ingress controller or application layer to prevent unusually large payloads from consuming server memory.

Generated by OpenCVE AI on May 9, 2026 at 05:21 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-jcc8-g2q4-9fxq	Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.599% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-42294
https://bugzilla.redhat.com/show_bug.cgi?id=2468443
https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965
https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14
https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42294.json

History

May 14, 2026 6:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Argoproj argo Workflows
CPEs		cpe:2.3:a:argoproj:argo_workflows::::::go::*
Vendors & Products		Argoproj argo Workflows
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

May 11, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 9, 2026 5:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Argoproj Argoproj argo-workflows
Vendors & Products		Argoproj Argoproj argo-workflows

May 9, 2026 4:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the /api/v1/events/ endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service. This issue has been patched in versions 3.7.14 and 4.0.5.
Title		Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Weaknesses		CWE-770
References		https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965 https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14 https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`