CVE-2022-24348

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-04 · updated 2026-06-17
Weakness: CWE-22

Description

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.

Affected products

argoproj argo-cd: before 2.1.9; from 2.2.0 before 2.2.4 — fixed in 2.1.9, 2.2.4

How to fix

Upgrade to a fixed version: argoproj argo-cd 2.1.9, 2.2.4. Check the vendor advisory for mitigations.

References

https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/
https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7
https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/
https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7

Get alerted when CVE-2022-24348 or the next vulnerability affects your stack