{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42294.json" } ], "title": "Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor", "tracking": { "current_release_date": "2026-06-30T03:57:26+00:00", "generator": { "date": "2026-06-30T03:57:26+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.0" } }, "id": "CVE-2026-42294", "initial_release_date": "2026-05-09T03:45:48.180000+00:00", "revision_history": [ { "date": "2026-05-09T03:45:48.180000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-06-25T10:43:43+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-30T03:57:26+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)", "product": { "name": "Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai)", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" }, { "category": "product_version", "name": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "product": { "name": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "product_id": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-data-science-pipelines-argo-argoexec-rhel9?repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9", "product": { "name": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9", "product_id": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-data-science-pipelines-argo-workflowcontroller-rhel9?repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-argoexec-rhel9" }, "product_reference": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9" }, "product_reference": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-42294", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-05-09T05:01:16.989261+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2468443" } ], "notes": [ { "category": "description", "text": "A flaw was found in Argo Workflows. The Webhook Interceptor, accessible via the /api/v1/events/ endpoint, loads the entire request body into memory before authenticating the request or verifying its signature. A remote attacker can exploit this by sending an extremely large request, causing the Argo Server to allocate excessive memory. This can lead to an Out-Of-Memory (OOM) crash, resulting in a denial of service (DoS) for the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenShift AI ships Argo Workflows in Data Science Pipelines container images (odh-data-science-pipelines-argo-workflowcontroller-rhel9 and odh-data-science-pipelines-argo-argoexec-rhel9) on affected streams. These images bundle a vulnerable Argo Workflows version prior to upstream fix 3.7.14.\n\nThe webhook interceptor reads the entire HTTP request body into memory before authenticating the request or verifying its signature on the /api/v1/events/ endpoint. An unauthenticated remote attacker can submit an extremely large request body, causing excessive memory allocation and potentially an out-of-memory crash of the Argo Server, resulting in denial of service for workflow execution and API access.\n\nRed Hat OpenShift AI engineering is expected to deliver updated container images built with Argo Workflows 3.7.14 or later (3.x line) or 4.0.5 or later (4.x line). Until updates are available, restrict network access to the Argo Server webhook endpoint and enforce request body size limits at the Ingress or load balancer layer as described in the mitigation field.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42294" }, { "category": "external", "summary": "RHBZ#2468443", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468443" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42294", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42294" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42294", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42294" }, { "category": "external", "summary": "https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965", "url": "https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965" }, { "category": "external", "summary": "https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14", "url": "https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14" }, { "category": "external", "summary": "https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5", "url": "https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5" }, { "category": "external", "summary": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq", "url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq" } ], "release_date": "2026-05-09T03:45:48.180000+00:00", "remediations": [ { "category": "workaround", "details": "Upgrade Argo Workflows to version 3.7.14 or later (3.x line) or 4.0.5 or later (4.x line) in affected Red Hat OpenShift AI releases. Red Hat OpenShift AI engineering is expected to deliver updated Data Science Pipelines builds for affected streams (rhoai-2.25, rhoai-3.3, rhoai-3.4).\n\nUntil updated images are available, restrict network access to the Argo Server webhook endpoint (/api/v1/events/) using Ingress rules, firewall policies, or Kubernetes NetworkPolicy so only trusted webhook sources can reach it. Configure request body size limits at the Ingress or load balancer layer (for example, a maximum body size well below multi-gigabyte payloads) to reduce the risk of memory exhaustion from oversized requests.", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-argoexec-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9" ] } ], "title": "Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor" } ] }