Unprivileged Pods Can Connect to Redis Server on Port 6379, Raising Security Concerns

CVE-2024-31989

What is CVE-2024-31989?

The Argo CD tool, a prominent solution for GitOps-based continuous delivery in Kubernetes, has a vulnerability that permits an unprivileged pod located in a different namespace within the same cluster to connect to the Redis server on port 6379. This issue arises despite the installation of the latest VPC CNI plugin on the EKS cluster, which mandates manual configuration to enforce network policies correctly. This oversight can lead to unintended exposure of Redis servers, potentially allowing unauthorized access to cluster controller privileges or leaking sensitive information. Affected users are advised to patch their installations to versions 2.8.19, 2.9.15, or 2.10.10 to mitigate these risks.

References