What’s Vulnerable › Vulnerabilities

CVE-2024-37152: Unauthenticated Access to sensitive settings in Argo CD

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-287

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Affected products

• argoproj argo-cd: from 2.9.3 before 2.9.17; from 2.10.0 before 2.10.12; from 2.11.0 before 2.11.3 — fixed in 2.10.12, 2.11.3, 2.9.17

How to fix

Upgrade to a fixed version: argoproj argo-cd 2.10.12, 2.11.3, 2.9.17. Check the vendor advisory for mitigations.

References

• https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2
• https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2

Get alerted when CVE-2024-37152 or the next vulnerability affects your stack