Argo Workflows (Argo Server, webhook interceptor /api/v1/events/): The webhook interceptor buffers the entire request

Impact

The webhook interceptor buffers the entire request body before it authenticates or verifies the signature, so a multi-gigabyte POST to the publicly reachable /api/v1/events/ endpoint drives Argo Server into OOM. Losing Argo Server takes down the UI and API that every tenant uses to submit and inspect workflows.

Who can reach it

Any unauthenticated host that can reach the Argo Server event endpoint. That is the internet wherever the webhook path is exposed for CI or Git integrations.

What to do

Upgrade Argo Server to 3.7.14 or 4.0.5 and restart. As defense in depth, cap request body size at the ingress or service mesh in front of /api/v1/events/ and set a memory limit on the Argo Server pod so an OOM restarts one pod instead of pressuring the node.

References