{"vulnerability": "cve-2026-93991", "sightings": [{"uuid": "b86c57a8-6045-4763-b0b6-36cfc8a89e38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93991", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvvs4b2ei62w", "content": "CVE-2026-93991: An authorization bypass in Argo Workflows lets a namespace-scoped user list archived workflows from other namespaces. Versions 4.1.0 through 4.1.3 are affected. Upgrade to 4.1.4. No exploitation confirmed.", "creation_timestamp": "2026-09-19T23:02:57.013085Z"}, {"uuid": "a1ed6985-2b54-419f-a0a7-31a501d859a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93991", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvvvfk5o7f2m", "content": "\ud83d\udfe0 CVE-2026-93991 - High (7.7)\n\nArgo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in List...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93991/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-20T00:01:50.373673Z"}, {"uuid": "95c9327e-f9be-40bc-8af8-dc8e84e7f935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93991", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/32uixto6kgixt", "content": "CVE-2026-93991 - Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector\nCVE ID : CVE-2026-93991\n \n Published : Sept. 19, 2026, 11:17 p.m. | 19\u00a0minutes ago\n \n Description : Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass v...", "creation_timestamp": "2026-09-20T00:04:36.791205Z"}, {"uuid": "d3403a7d-76a4-4642-a78c-e058dc844507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93991", "type": "seen", "source": "https://gist.github.com/ichintu/cdeedf6435a1cfc4f0c1b67ededf1aba", "content": "This daily threat intelligence update highlights two critical vulnerabilities disclosed in September 2026:\n\u2022 **CVE-2026-93958 (Critical, 9.1):** A remote OS command injection flaw in D-Link R95 routers, exploitable via the DHMAPI component's `NTPServer` argument.\n\u2022 **CVE-2026-93991 (High, 8.3):** An authorization bypass in Argo Workflows (v4.1.0\u20134.1.3) that allows attackers to bypass namespace restrictions and expose sensitive archived workflow data using negated field selectors.\n\nBoth vulnerabilities feature publicly disclosed, functional exploits, necessitating immediate patching or mitigation.", "creation_timestamp": "2026-09-20T04:01:15.948370Z"}]}