cve/2024/CVE-2024-47827.md

### [CVE-2024-47827](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47827)
![](https://img.shields.io/static/v1?label=Product&message=argo-workflows&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.6.0-rc1%2C%20%3C%203.6.0-rc2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=3.6.0-rc1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1108%3A%20Excessive%20Reliance%20on%20Global%20Variables&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-362%3A%20Concurrent%20Execution%20using%20Shared%20Resource%20with%20Improper%20Synchronization%20('Race%20Condition')&color=brightgreen)

### Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.

### POC

#### Reference
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr

#### Github
No PoCs found on GitHub currently.