argoproj argo-workflows up to 3.7.13/4.0.4 Request Body /api/v1/events/ allocation of resources

Summaryinfo

A vulnerability marked as problematic has been reported in argoproj argo-workflows up to 3.7.13/4.0.4. Affected by this vulnerability is an unknown functionality of the file /api/v1/events/ of the component Request Body Handler. Performing a manipulation results in allocation of resources. This vulnerability was named CVE-2026-42294. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in argoproj argo-workflows up to 3.7.13/4.0.4. It has been classified as problematic. This affects an unknown code of the file /api/v1/events/ of the component Request Body Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the /api/v1/events/ endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service. This issue has been patched in versions 3.7.14 and 4.0.5.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-42294 since 04/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 3.7.14 or 4.0.5 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 7abb4de6c3599e2d5d960ba4d5de4cf1df109965 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• argoproj

Name

• argo-workflows

Version

• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8
• 3.7.9
• 3.7.10
• 3.7.11
• 3.7.12
• 3.7.13
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4

License

• open-source

Website

• Product: https://github.com/argoproj/argo-workflows/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion