{"id":"GHSA-jcc8-g2q4-9fxq","summary":"Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor","details":"**Severity:** Medium\n**Component:** Webhook Interceptor (`server/auth/webhook`)\n**Vulnerability Type:** Denial of Service (DoS)\n\n## Description\nThe Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the `/api/v1/events/` endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service.\n\n## Vulnerable Code\nIn `server/auth/webhook/interceptor.go`:\n```go\nfunc (i *WebhookInterceptor) addWebhookAuthorization(r *http.Request, kube kubernetes.Interface) error {\n    // ... basic checks ...\n    \n    // Vulnerability: Reads entire body into memory unconditionally\n    buf, _ := io.ReadAll(r.Body)\n    defer func() { r.Body = io.NopCloser(bytes.NewBuffer(buf)) }()\n    \n    // ... subsequent logic finds correct service account and secret ...\n    // ... verification happens later ...\n}\n```\nThe `io.ReadAll` call happens before the signature verification loop.\n\n## Impact\n- **Service Availability:** An attacker can crash the Argo Server, disrupting workflow execution and API access for all users.\n\n## PoC (Conceptual)\n1.  Target the webhook endpoint: `POST /api/v1/events/some-namespace`\n2.  Send a `Content-Length: 1000000000` (1GB) header.\n3.  Stream 1GB of random data.\n4.  Monitor server memory usage. It will spike until 1GB is allocated or the process crashes.\n\n## Recommendation\n1.  **Limit Body Size:** Enforce a strict limit on webhook body size (e.g., 10MB) using `http.MaxBytesReader`.\n2.  **Streaming Verification:** If possible, verify the signature in a streaming fashion or use a temporary file for large payloads (though typically webhooks are small).","aliases":["BIT-argo-workflows-2026-42294","CVE-2026-42294","GO-2026-5462"],"modified":"2026-07-21T15:00:32.460177842Z","published":"2026-05-04T20:11:01Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-05-04T20:11:01Z","nvd_published_at":"2026-05-09T04:16:24Z","cwe_ids":["CWE-770"]},"references":[{"type":"WEB","url":"https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42294"},{"type":"WEB","url":"https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-42294"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468443"},{"type":"PACKAGE","url":"https://github.com/argoproj/argo-workflows"},{"type":"WEB","url":"https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14"},{"type":"WEB","url":"https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42294.json"}],"affected":[{"package":{"name":"github.com/argoproj/argo-workflows/v3","ecosystem":"Go","purl":"pkg:golang/github.com/argoproj/argo-workflows/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.14"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jcc8-g2q4-9fxq/GHSA-jcc8-g2q4-9fxq.json"}},{"package":{"name":"github.com/argoproj/argo-workflows/v4","ecosystem":"Go","purl":"pkg:golang/github.com/argoproj/argo-workflows/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jcc8-g2q4-9fxq/GHSA-jcc8-g2q4-9fxq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}