REDHAT-BUG-2468448: High severity Argo Argo Workflows vulnerability
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/synccm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Argo Workflows (Sync Service)to a version that resolves this vulnerability.Fixed in 4.0.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2468448?
The severity of REDHAT-BUG-2468448 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2468448?
To fix REDHAT-BUG-2468448, upgrade Argo Workflows to version 4.0.5 or later.
What type of vulnerability is REDHAT-BUG-2468448?
REDHAT-BUG-2468448 is a security vulnerability related to improper authorization checks in the Sync Service of Argo Workflows.
Which versions of Argo Workflows are affected by REDHAT-BUG-2468448?
Versions 4.0.0 to just before 4.0.5 of Argo Workflows are vulnerable as per REDHAT-BUG-2468448.
What impact does REDHAT-BUG-2468448 have on Argo Workflows?
REDHAT-BUG-2468448 allows unauthorized users to perform CRUD operations against the Sync Service, potentially leading to data manipulation.