The Sync Service’s ConfigMap‑backed provider in Argo Workflows implements no authorization checks for any CRUD operation. Consequently, any authenticated user—including one using a fabricated Bearer token—can create, read, update, or delete configuration in Kubernetes ConfigMaps that control workflow synchronization limits. Based on the description, it is inferred that manipulating these limits could lead to uncontrolled resource use, denial of service, or privilege escalation within the cluster.

Versions of Argo Workflows from 4.0.0 up to 4.0.4 are affected. The vendor is argoproj:argo-workflows, and the flaw exists only in the Sync Service’s ConfigMap provider component. The problem was fixed in release 4.0.5.

The CVSS score of 8.5 denotes high severity. Although the EPSS score is not provided, based on the description it is inferred that exploitation is likely if an attacker gains any authenticated access or is able to produce a forged token. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the bug by sending authenticated requests to the Sync Service endpoints to manipulate ConfigMaps, potentially enabling escalation or disruption of workflow orchestration.