CVE-2026-42294

[CVE catalog]

Severity

High · CVSS 8.2

Published

May 9, 2026, 3:45:48 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.60% · Oct 25, 2026

A flaw was found in Argo Workflows. The Webhook Interceptor, accessible via the /api/v1/events/ endpoint, loads the entire request body into memory before authenticating the request or verifying its signature. A remote attacker can exploit this by sending an extremely large request, causing the Argo Server to allocate excessive memory. This can lead to an Out-Of-Memory (OOM) crash, resulting in a denial of service (DoS) for the affected system. Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor Red Hat OpenShift AI ships Argo Workflows in Data Science Pipelines container images (odh-data-science-pipelines-argo-workflowcontroller-rhel9 and odh-data-science-pipelines-argo-argoexec-rhel9) on affected streams. These images bundle a vulnerable Argo Workflows version prior to upstream fix 3.7.14. The webhook interceptor reads the entire HTTP request body into memory before authenticating the request or verifying its signature on the /api/v1/events/ endpoint. An unauthenticated remote attacker can submit an extremely large request body, causing excessive memory allocation and potentially an out-of-memory crash of the Argo Server, resulting in denial of service for workflow execution and API access. Red Hat OpenShift AI engineering is expected to deliver updated container images built with Argo Workflows 3.7.14 or later (3.x line) or 4.0.5 or later (4.x line). Until updates are available, restrict network access to the Argo Server webhook endpoint and enforce request body size limits at the Ingress or load balancer layer as described in the mitigation field. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.