Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the brute force login protection mechanism. Not only can they crash the service affecting all users, but they can also make unlimited login attempts, increasing the risk of account compromise. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-cd | < 2.8.13, >= 2.9.0, < 2.9.9, >= 2.10.0, < 2.10.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Gitops 1 | microshift-gitops +3 | 1.12.1-4.el9 | RHSA-2024:1752 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-cd/v2 | < 2.8.13 | 2.8.13 | GHSA-2vgg-9h6w-m454 |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.9.0, < 2.9.9 | 2.9.9 | GHSA-2vgg-9h6w-m454 |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.10.0, < 2.10.4 | 2.10.4 | GHSA-2vgg-9h6w-m454 |
| Go | github.com/argoproj/argo-cd/v2 | < 2.8.13 · >= 2.9.0, < 2.9.9 · >= 2.10.0, < 2.10.4 | 2.8.13, 2.9.9, 2.10.4 | GO-2024-2652 |
Advisories 2
- RHSA-2024:1752 Red Hat Security Advisory: GitOps 1.12.1- Argo CD CLI and MicroShift GitOps security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- WID-SEC-2024-0812 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2024