High 7.7Published Sep 19, 2026

CVE-2026-93991Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Updated under an hour ago (Oct 28, 2026, 3:10 AM ET)

Does this affect you?

It affects argoproj argo-workflows. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for argoproj argo-workflows

Exploited in the last 30 days

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.

CVSS: 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-639
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Sep 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

argoproj argo-workflows argoproj:argo_workflows (from the name)	from 4.1.0 before 4.1.4	CNA record

References

References

https://github.com/argoproj/argo-workflows/security/advisories/GHSA-q65w-j2vp-47c4	vendor-advisory
https://github.com/argoproj/argo-workflows/commit/a40972386c097ddf816d2e60e13f058bedca53d9	patch
https://github.com/argoproj/argo-workflows/releases/tag/v4.1.4	release-notes
https://github.com/argoproj/argo-workflows	product
https://www.vulncheck.com/advisories/argo-workflows-4.1.0-through-4.1.3-cross-namespace-disclosure-via-negated-selector	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.