CVE-2022-24768

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications.

• CWE-200
• CWE-862

• https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cfPatch, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.1.14Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.2.8Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.3.2Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pwwMitigation, Third Party Advisory
• https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cfPatch, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.1.14Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.2.8Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.3.2Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pwwMitigation, Third Party Advisory

Published

Mar 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24762sysend.js is a library that allows a user to send messages b…6.5
• CVE-2022-24763PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24764PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24765Git for Windows is a fork of Git containing Windows-specific…7.8
• CVE-2022-24766mitmproxy is an interactive, SSL/TLS-capable intercepting pr…9.8
• CVE-2022-24767GitHub: Git for Windows' uninstaller vulnerable to DLL hijac…7.8
• CVE-2022-24769Moby is an open-source project created by Docker to enable a…5.9
• CVE-2022-2477Use after free in Guest View in Google Chrome prior to 103.0…8.8
• CVE-2022-24770`gradio` is an open source framework for building interactiv…8.8
• CVE-2022-24771Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2022-24772Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2022-24773Forge (also called `node-forge`) is a native implementation …5.3