A high-severity authorization bypass in Argo Workflows 4.1.0 through 4.1.3 allows authenticated users to access sensitive workflow data across namespaces.

This flaw is an authorization bypass (CWE-639) occurring in the ListArchivedWorkflows function. An authenticated user with limited namespace-scoped permissions can leverage a negated metadata.namespace field selector to bypass cluster-scoped access reviews, enabling the retrieval of sensitive spec arguments and parameters from other namespaces.

The vulnerability poses a significant risk to data confidentiality by exposing internal workflow configurations, sensitive parameters, and metadata. With a CVSS score of 7.7, this issue enables lateral information gathering within a Kubernetes environment, potentially leading to the exposure of secrets or credentials stored in workflow arguments. This unauthorized access could facilitate further attacks against the infrastructure or internal business logic.

Immediate Action: Upgrade to Argo Workflows version 4.1.4 or later immediately to resolve the authorization logic flaw.

Proactive Monitoring: Review audit logs for unusual API activity, specifically focusing on ListArchivedWorkflows requests containing the NotEquals operator within namespace selectors.

Compensating Controls: If an immediate upgrade is not feasible, restrict user permissions to the absolute minimum required and consider implementing network policies or RBAC restrictions to limit the blast radius of potential unauthorized data access.

Public Exploit Available: Unknown

Given the severity of this authorization bypass, administrators must prioritize the update to version 4.1.4. Failure to patch allows users with standard access to perform cross-namespace data harvesting, which compromises the security posture of the entire Argo Workflows deployment. Update all affected instances as part of the next maintenance cycle to restore proper authorization controls.