{"id":"CVE-2026-42294","aliases":["BIT-argo-workflows-2026-42294","GHSA-jcc8-g2q4-9fxq","GO-2026-5462"],"url":"https://o3.security/vulnerability/CVE-2026-42294","summary":"Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor","details":"**Severity:** Medium\n**Component:** Webhook Interceptor (`server/auth/webhook`)\n**Vulnerability Type:** Denial of Service (DoS)\n\n## Description\nThe Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the `/api/v1/events/` endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service.\n\n## Vulnerable Code\nIn `server/auth/webhook/interceptor.go`:\n```go\nfunc (i *WebhookInterceptor) addWebhookAuthorization(r *http.Request, kube kubernetes.Interface) error {\n    // ... basic checks ...\n    \n    // Vulnerability: Reads entire body into memory unconditionally\n    buf, _ := io.ReadAll(r.Body)\n    defer func() { r.Body = io.NopCloser(bytes.NewBuffer(buf)) }()\n    \n    // ... subsequent logic finds correct service account and secret ...\n    // ... verification happens later ...\n}\n```\nThe `io.ReadAll` call happens before the signature verification loop.\n\n## Impact\n- **Service Availability:** An attacker can crash the Argo Server, disrupting workflow execution and API access for all users.\n\n## PoC (Conceptual)\n1.  Target the webhook endpoint: `POST /api/v1/events/some-namespace`\n2.  Send a `Content-Length: 1000000000` (1GB) header.\n3.  Stream 1GB of random data.\n4.  Monitor server memory usage. It will spike until 1GB is allocated or the process crashes.\n\n## Recommendation\n1.  **Limit Body Size:** Enforce a strict limit on webhook body size (e.g., 10MB) using `http.MaxBytesReader`.\n2.  **Streaming Verification:** If possible, verify the signature in a streaming fashion or use a temporary file for large payloads (though typically webhooks are small).","published":"2026-05-09T03:45:48.180Z","modified":"2026-08-12T03:51:29.901322585Z","cvss":null,"epss":{"score":0.00607,"percentile":0.47522,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v3","fixedVersion":"3.7.14"},{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v4","fixedVersion":"4.0.5"}],"fix":{"url":"https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965","label":"argoproj/argo-workflows@7abb4de"},"references":[{"type":"WEB","url":"https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14"},{"type":"WEB","url":"https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42294.json"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42294"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42294.json"},{"type":"ADVISORY","url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42294"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468443"},{"type":"FIX","url":"https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965"},{"type":"PACKAGE","url":"https://github.com/argoproj/argo-workflows"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.901322585Z"}}