CVE-2026-42294
Description
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the /api/v1/events/ endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service. This issue has been patched in versions 3.7.14 and 4.0.5.
How to fix
- argoproj argo_workflows3.7.14, 4.0.5 or later
- github.com/argoproj/argo-workflows/v33.7.14 or later
- github.com/argoproj/argo-workflows/v44.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| argoproj argo_workflows | v < 3.7.14, 4.0.0 ≤ v < 4.0.5 | 3.7.14, 4.0.5 |
| github.com/argoproj/argo-workflows/v3Go | v < 3.7.14 | 3.7.14 |
| github.com/argoproj/argo-workflows/v4Go | 4.0.0 ≤ v < 4.0.5 | 4.0.5 |
| github.com/argoproj/argo-workflowsGo | No range specified | — |
| github.com/argoproj/argo-workflows/v2Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.