What’s Vulnerable › Vulnerabilities

CVE-2024-31989: ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-05-21 · updated 2026-06-17
• Weakness: CWE-327

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.

Affected products

• argoproj argo-cd: before 2.8.19; from 2.9.0 before 2.9.15; from 2.10.0 before 2.10.10; from 2.11.0 before 2.11.1 — fixed in 2.10.10, 2.11.1, 2.8.19, 2.9.15

How to fix

Upgrade to a fixed version: argoproj argo-cd 2.10.10, 2.11.1, 2.8.19, 2.9.15. Check the vendor advisory for mitigations.

References

• https://github.com/argoproj/argo-cd/commit/2de0ceade243039c120c28374016c04ff9590d1d
• https://github.com/argoproj/argo-cd/commit/35a7d6c7fa1534aceba763d6a68697f36c12e678
• https://github.com/argoproj/argo-cd/commit/4e2fe302c3352a0012ecbe7f03476b0e07f7fc6c
• https://github.com/argoproj/argo-cd/commit/53570cbd143bced49d4376d6e31bd9c7bd2659ff
• https://github.com/argoproj/argo-cd/commit/6ef7b62a0f67e74b4aac2aee31c98ae49dd95d12
• https://github.com/argoproj/argo-cd/commit/9552034a80070a93a161bfa330359585f3b85f07
• https://github.com/argoproj/argo-cd/commit/bdd889d43969ba738ddd15e1f674d27964048994
• https://github.com/argoproj/argo-cd/commit/f1a449e83ee73f8f14d441563b6a31b504f8d8b0
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-9766-5277-j5hr
• https://github.com/argoproj/argo-cd/commit/2de0ceade243039c120c28374016c04ff9590d1d
• https://github.com/argoproj/argo-cd/commit/35a7d6c7fa1534aceba763d6a68697f36c12e678
• https://github.com/argoproj/argo-cd/commit/4e2fe302c3352a0012ecbe7f03476b0e07f7fc6c

Get alerted when CVE-2024-31989 or the next vulnerability affects your stack