Skip to content
fr Sign in
5.3 Medium

CVE-2024-37152 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Affected products and versions

Product Affected versions Fixed in
argo-cd 2.11 2.11.0 → < 2.11.3 2.11.3
argo-cd 2.10 2.10.0 → < 2.10.12 2.10.12
argo-cd 2.9 2.9.3 → < 2.9.17 2.9.17
argo-cd 2.11 2.11.0 → < 2.11.3 2.11.3
argo-cd 2.10 2.10.0 → < 2.10.2 2.10.2
argo-cd 2.9 2.9.3 → < 2.9.17 2.9.17

References

Timeline

  1. Published
  2. Last modified

Other CVEs of argo-cd

The 49 CVEs of argo-cd →
CVE-2026-113709 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical CVE-2026-113708 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical CVE-2026-113672 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical CVE-2026-77459 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical
Track this CVE