Brute Force Login Bypass in Argo CD by Vendor Argo Project

CVE-2024-21652

What is CVE-2024-21652?

Argo CD, a powerful GitOps continuous delivery tool for Kubernetes, is vulnerable to a critical flaw that allows attackers to bypass its brute force login protection mechanism. Prior to the updates in versions 2.8.13, 2.9.9, and 2.10.4, cybercriminals could exploit a chain of issues, including a Denial of Service (DoS) vulnerability and weaknesses in in-memory data storage. This exploitation not only enables unlimited login attempts, significantly raising the threat of account compromise, but it can also lead to service disruptions affecting all users. Users are strongly advised to upgrade to the patched versions to mitigate these risks.

References