CVE-2026-93991: Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs namespace-scoped permission to list archived workflows. They can then submit a ListArchivedWorkflows request using a metadata.namespace field selector with the NotEquals operator.
What information could be exposed?
The issue can disclose archived workflows from other namespaces, including workflow spec arguments, parameter values, and annotations. The described impact is confidentiality exposure; integrity and availability impacts are not identified.
Are all deployments affected by default?
Only Argo Workflows 4.1.0 through 4.1.3 are identified as affected. Exploitation additionally depends on a user or service account having namespace-scoped archived-workflow list permissions.
How can I determine whether exploitation may have occurred?
Review ListArchivedWorkflows requests from principals with namespace-scoped list permissions for metadata.namespace selectors using the NotEquals operator. Such requests may have returned archived workflows outside the caller's authorized namespace.
What remediation is available?
Upgrade to Argo Workflows 4.1.4, which is identified in the provided release reference as the available fixed release. If upgrading is delayed, restrict namespace-scoped principals' ability to list archived workflows where operationally feasible.