CVE-2026-93991

Received Received - Intake

Authorization Bypass in Argo Workflows via ListArchivedWorkflows

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93991

Affected Vendors & Products

Vendor	Product	Version / Range
argo	workflows	From 4.1.0 (inc) to 4.1.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Argo Workflows versions 4.1.0 through 4.1.3 allows attackers with limited permissions to bypass authorization checks. By using a negated namespace field selector, they can access archived workflows from all namespaces, not just their own. This exposes sensitive data like workflow specifications, parameters, and annotations.

Impact Analysis

If you use Argo Workflows in your environment, attackers could exploit this to steal confidential workflow data across all namespaces. This may lead to data breaches, unauthorized access to sensitive operations, or exposure of internal configurations. The impact depends on the sensitivity of the workflows stored.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to protected data. GDPR requires strict data access controls, while HIPAA mandates protection of health information. Exploitation may result in regulatory penalties due to data exposure.

Mitigation Strategies

Upgrade Argo Workflows to a version that patches this vulnerability. Specifically, versions 4.1.0 through 4.1.3 are affected, so update to a version beyond 4.1.3.

Hi! I’m here to help you understand CVE-2026-93991. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70