Is CVE-2026-42296 actively exploited?

No active exploitation of CVE-2026-42296 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42296 be exploited remotely?

Yes. CVE-2026-42296 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-42296?

CVE-2026-42296 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-42296

HIGH

CVE-2026-42296

CWE-863Published: May 9, 2026· Updated: May 15, 2026

8.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.0th

Official Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod security context, add tolerations to schedule on control-plane nodes, or enable SA token mounting. This defeats the stated purpose of the feature. The practical impact depends on what Kubernetes-level controls are in place. Clusters with PodSecurity admission or OPA/Gatekeeper would independently block some of these (like hostNetwork). Clusters that rely on Argo's Strict mode as the primary enforcement layer are fully exposed. This issue has been patched in versions 3.7.14 and 4.0.5.

NVD Source

Technical Analysis

CVE-2026-42296 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.