CyberRota Analysis
AI-GeneratedArgo Workflows versions 4.1.0 to 4.1.3 are vulnerable to an authorization bypass in the ListArchivedWorkflows function, allowing attackers with namespace-scoped list permissions to exploit a flaw in the metadata.namespace field selector. This vulnerability enables unauthorized access to archived workflows across all namespaces, potentially exposing sensitive information such as spec arguments and parameter values. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.