Argo Workflows’ Webhook Interceptor reads the entire request body into memory before performing authentication or signature validation. The /api/v1/events endpoint is publicly reachable, and an attacker can send a request with an extremely large body. The unbounded memory allocation can exhaust the Argo Server’s resources, causing an Out‑Of‑Memory crash and resulting in denial of service. This flaw corresponds to CWE‑770: Excessive Resource Consumption.

The vulnerability affects the open‑source Argo Workflows engine delivered by argoproj. Versions prior to 3.7.14 and 4.0.5 are susceptible; the issue was addressed in the 3.7.14 and 4.0.5 releases.

The CVSS score of 8.2 indicates a high severity, and the vulnerability is not currently listed in the CISA KEV catalog. Because the /api/v1/events endpoint is reachable without authentication, an attacker can trigger the exploit over the public network. There is no EPSS score available, but the potential for resource exhaustion remains significant. The attack vector is a simple HTTP POST to the webhook endpoint with a large payload, which an adversary can conduct from any network location with connectivity to the Argo API.