Unauthorized Access to Sensitive Settings in Argo CD

CVE-2024-37152

Summary

Argo CD, a GitOps continuous delivery tool for Kubernetes, has been identified with a vulnerability that permits unauthorized access to sensitive configuration settings exposed at the /api/v1/settings endpoint. This significant flaw allows malicious actors to gain insights into sensitive infrastructure information, which could compromise the security of the deployment. Notably, while most sensitive settings are protected, the passwordPattern remains accessible without authentication. Users of Argo CD version 2.11.2 and earlier, as well as version 2.10.11 and below, are urged to upgrade to the patched versions, specifically 2.11.3, 2.10.12, and 2.9.17, to mitigate this risk. For more technical details, please refer to the advisory on GitHub.

References