Go/github.com/argoproj/argo-workflows/v4 CVE-2026-42297: high, EPSS 0.53%

Argo has Missing Authorization in its Sync ConfigMap Provider

Action: Upgrade github.com/argoproj/argo-workflows/v4 to 4.0.5 or later.

go get github.com/argoproj/argo-workflows/v4@v4.0.5

Affected

Fixed versions

Sources

• osv: GHSA-xchc-cqwg-g76q
• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q
• https://nvd.nist.gov/vuln/detail/CVE-2026-42297
• https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6
• https://github.com/argoproj/argo-workflows
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5

CVE-2026-42297 · published 2026-05-04T20:00:18Z · modified 2026-09-10T03:50:48.081823135Z · JSON