CVE-2026-42183
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.
| CWE | CWE-476 |
| Vendor | argoproj |
| Product | argo-workflows |
| Published | May 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for argoproj argo-workflows
Be the first to know when new unknown vulnerabilities affecting argoproj argo-workflows are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
argoproj / argo-workflows
>= 4.0.0, < 4.0.5