What’s Vulnerable › Vulnerabilities

CVE-2024-31990: Argo CD' API server does not enforce project sourceNamespaces

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-15 · updated 2026-06-17
• Weakness: CWE-863

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

Affected products

• argoproj argo-cd: from 2.4.0 before 2.8.16; from 2.9.0 before 2.9.12; from 2.10.0 before 2.10.7 — fixed in 2.10.7, 2.8.16, 2.9.12

How to fix

Upgrade to a fixed version: argoproj argo-cd 2.10.7, 2.8.16, 2.9.12. Check the vendor advisory for mitigations.

References

• https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c
• https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5
• https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c
• https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c
• https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5
• https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c

Get alerted when CVE-2024-31990 or the next vulnerability affects your stack