CVE-2024-21662

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch.

• CWE-307
• CWE-307

• https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-forceVendor Advisory
• https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4dPatch
• https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7bPatch
• https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456Patch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454Exploit, Vendor Advisory
• https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-forceVendor Advisory
• https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4dPatch
• https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7bPatch
• https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456Patch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454Exploit, Vendor Advisory

Published

Mar 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21653The vantage6 technology enables to manage and deploy privacy…9.8
• CVE-2024-21654Rubygems.org is the Ruby community's gem hosting service. Ru…9.8
• CVE-2024-21655Discourse is a platform for community discussion. For fields…4.3
• CVE-2024-21658discourse-calendar is a discourse plugin which adds the abil…4.3
• CVE-2024-2166Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-21661Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-21663Discord-Recon is a Discord bot created to automate bug bount…8.8
• CVE-2024-21664jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS…7.5
• CVE-2024-21665ecommerce-framework-bundle is the Pimcore Ecommerce Framewor…4.3
• CVE-2024-21666The Customer Management Framework (CMF) for Pimcore adds fun…6.5
• CVE-2024-21667pimcore/customer-data-framework is the Customer Management F…6.5
• CVE-2024-21668react-native-mmkv is a library that allows easy use of MMKV …4.9