argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

CVE-2023-22736

What is CVE-2023-22736?

Argo CD, a continuous delivery tool for Kubernetes, is affected by an authorization bypass vulnerability that allows users to deploy applications in unauthorized namespaces. If sharding is enabled and the 'apps-in-any-namespace' feature is configured, the Application controller may reconcile applications outside the allowed configurations. This vulnerability occurs when the namespaces are set to a pattern like 'argocd-*', enabling access to other namespaces if a valid AppProject is present. A patch is available in versions 2.5.8 and 2.6.0-rc5, and organizations should consider restricting AppProjects and limiting Application controller replicas to mitigate risk.

References