Argo Workflows CVE-2026-93991

Requires an authenticated principal (PR:L) that already holds namespace-scoped 'list' permission on archived workflows in at least one namespace, and the Argo Workflows Server running an affected version (4.1.0 through 4.1.3) with the workflow-archive feature enabled and populated. Exploitation is performed by supplying a metadata.namespace field selector using the NotEquals operator (e.g. 'metadata.namespace!=<own-ns>'). Limiting factors: the attacker must be authenticated and possess at least single-namespace list rights, the archive persistence must be in use, and the value of the disclosure depends on the deployment being genuinely multi-tenant (namespaces as trust boundaries) - in a single-tenant cluster the exposed data may already be accessible to that user.

This is a genuine, well-substantiated priority for multi-tenant Argo Workflows deployments, though not a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 8.3) indicates a network-reachable, low-complexity attack requiring only low privileges - specifically an already-authenticated user with namespace-scoped list permissions. The high score is driven by VC:H combined with SC:H (subsequent/scope impact), correctly modeling that a single-namespace tenant can read data belonging to every OTHER namespace - a cross-tenant confidentiality breach in a system whose entire security model is namespace isolation. No EPSS score, KEV listing, or public POC is provided, so there is NO evidence of active exploitation or widespread automated attacks; this is currently a disclosed-and-patched issue rather than an in-the-wild threat. The confidentiality boundary broken is real (the source-code commit confirms the exact root cause), but impact is limited to information disclosure - no integrity or availability effect (VI/VA:N). Net: high-value in shared/multi-tenant clusters where namespaces are trust boundaries; lower urgency in single-tenant clusters where a namespace-scoped user could see cluster data anyway.

An attacker (or curious/compromised low-privilege tenant) holding list permission for archived workflows in only their own Kubernetes namespace sends a ListArchivedWorkflows request with the field selector 'metadata.namespace!=user-ns'. Because the NotEquals operator bypasses the cluster-wide access-review check, the server returns archived workflows from all other namespaces, leaking their spec arguments, parameter values, and annotations - which commonly contain secrets, tokens, connection strings, and internal configuration. No public POC is referenced, but the trigger is a single crafted API/CLI query, trivially reproducible from the advisory and commit.