GHSA-xchc-cqwg-g76q

Описание

Summary

The Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits.

Details

The ConfigMap-backed provider (server/sync/sync_cm.go) has no auth.CanI checks:

• server/sync/sync_cm.go — lines 23-155
• All four SyncService endpoints: CreateSyncLimit, GetSyncLimit, UpdateSyncLimit, DeleteSyncLimit

PoC

Prerequisites

• Argo Server running with --auth-mode=server
• Port-forward: kubectl port-forward -n argo svc/argo-server 2746:2746

Step 1: Create Sync Limit (Fake Token)

Result: {"namespace":"default","cmName":"test-sync","key":"test-key","limit":5}

Verify ConfigMap was created in Kubernetes:

Step 2: Read Sync Limit (Fake Token)

Result: {"namespace":"default","cmName":"test-sync","key":"test-key","limit":5}

Step 3: Update Sync Limit (Fake Token)

Result: {"namespace":"default","cmName":"test-sync","key":"test-key","limit":999}

Verify the ConfigMap was actually modified:

Impact

An attacker with network access to the Argo Server can:

1. Denial of Service — Set sync limits to 0 or 1, blocking all parallel workflow execution
2. Workflow Disruption — Modify existing sync limits to break running workflows
3. Information Disclosure — Read ConfigMap data that may contain sensitive configuration
4. Arbitrary ConfigMap Manipulation — Create/delete ConfigMaps in any namespace accessible to the server's service account

Related CVEs

• CVE-2026-28229 (GHSA-56px-hm34-xqj5): Unauthorized access to WorkflowTemplate endpoints — same root cause (missing auth.CanI check)
• CVE-2024-53862 (GHSA-h36c-m3rf-34h9): Archived workflow auth bypass — same pattern