Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-cd | >= 2.9.3, < 2.9.17, >= 2.10.0, < 2.10.12, >= 2.11.0, < 2.11.3 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Argo CD Unauthenticated Access to sensitive setting http/cves/2024/CVE-2024-37152.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-cd | all versions | — | GO-2024-2902 |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.9.3, < 2.9.17 · >= 2.10.0, < 2.10.12 · >= 2.11.0, < 2.11.3 | 2.9.17, 2.10.12, 2.11.3 | GO-2024-2902 |
| Go | github.com/argoproj/argo-cd/v2/server | >= 2.9.3, < 2.9.17 | 2.9.17 | GHSA-87p9-x75h-p4j2 |
| Go | github.com/argoproj/argo-cd/v2/server | >= 2.10.0, < 2.10.12 | 2.10.12 | GHSA-87p9-x75h-p4j2 |
| Go | github.com/argoproj/argo-cd/v2/server | >= 2.11.0, < 2.11.3 | 2.11.3 | GHSA-87p9-x75h-p4j2 |