CVE-2022-24829

Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api endpoint on the local server that is responsible for serving the Garden dashboard. At the moment, this server is accessible to 0.0.0.0 which makes it accessible to anyone on the same network (or anyone on the internet if they are on a public, static IP). This may lead to the ability to compromise credentials, secrets or environment variables. Users are advised to upgrade to version 0.12.39 as soon as possible. Users unable to upgrade should use a firewall blocking access to port 9777 from all untrusted network machines.

• CWE-306

• https://github.com/garden-io/garden/commit/56051a5b50409227bc420910da88ed156a6e432bPatch, Third Party Advisory
• https://github.com/garden-io/garden/security/advisories/GHSA-f5f3-qrqw-2vqfThird Party Advisory
• https://github.com/garden-io/garden/commit/56051a5b50409227bc420910da88ed156a6e432bPatch, Third Party Advisory
• https://github.com/garden-io/garden/security/advisories/GHSA-f5f3-qrqw-2vqfThird Party Advisory

Published

Apr 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24823Netty is an open-source, asynchronous event-driven network a…5.5
• CVE-2022-24824Discourse is an open source platform for community discussio…5.3
• CVE-2022-24825Smokescreen is a simple HTTP proxy that fogs over naughty UR…5.3
• CVE-2022-24826On Windows, if Git LFS operates on a malicious repository wi…7.8
• CVE-2022-24827Elide is a Java library that lets you stand up a GraphQL/JSO…8.1
• CVE-2022-24828Composer is a dependency manager for the PHP programming lan…8.8
• CVE-2022-2483 The bootloader in the Nokia ASIK AirScale system module (ve…7.1
• CVE-2022-24830OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24831OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24832GoCD is an open source a continuous delivery server. The bun…6.8
• CVE-2022-24833PrivateBin is minimalist, open source online pastebin clone …6.1
• CVE-2022-24834Redis is an in-memory database that persists on disk. A spec…8.8