Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass that allows an attacker with namespace‑scoped list permissions to retrieve archived workflows from any namespace by using a negated namespace field selector in the ListArchivedWorkflows API call. The flaw causes cluster‑scoped access checks to be omitted, exposing workflow specifications, parameter values, and annotations to unauthorized users. This results in unintended disclosure of potentially sensitive configuration data and execution details across namespace boundaries.

The affected product is Argo Workflows produced by argoproj, specifically the 4.1.0 to 4.1.3 releases. Users deploying these versions within a Kubernetes cluster are vulnerable.

The CVSS score of 8.3 classifies the vulnerability as High severity, and although an EPSS score is not available, the lack of a KEV listing does not diminish the risk to environments where untrusted users can obtain namespace‑scoped list permissions. The likely attack vector is a craftedd API request sent from within the cluster, potentially by a malicious pod or a compromised user who has limited read access to a namespace. If successful, the attacker can gather sensitive workflow data from all other namespaces.