CVE-2024-52814

Argo Helm is a collection of community maintained charts for `argoproj.github.io` projects. Prior to version 0.45.0, the `workflow-role`) lacks granularity in its privileges, giving permissions to `workflowtasksets` and `workflowartifactgctasks` to all workflow Pods, when only certain types of Pods created by the Controller require these privileges. The impact is minimal, as an attack could only affect status reporting for certain types of Pods and templates. Version 0.45.0 fixes the issue.

• CWE-1220

• https://github.com/argoproj/argo-helm/blob/2653aef414ab6a5d8617af75f04190a8f7da28dc/charts/argo-workflows/templates/controller/workflow-role.yaml
• https://github.com/argoproj/argo-helm/blob/2653aef414ab6a5d8617af75f04190a8f7da28dc/charts/argo-workflows/templates/controller/workflow-role.yaml#L45-L56
• https://github.com/argoproj/argo-helm/security/advisories/GHSA-h974-w8pg-cx73
• https://github.com/argoproj/argo-workflows/blob/5aac5a8f61f4e8273d04509dffe7d80123ff67f5/manifests/quick-start/base/agent-role.yaml
• https://github.com/argoproj/argo-workflows/blob/5aac5a8f61f4e8273d04509dffe7d80123ff67f5/manifests/quick-start/base/artifactgc-role.yaml

Published

Nov 22, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52809vue-i18n is an internationalization plugin for Vue.js. In a…5.3
• CVE-2024-5281The wp-affiliate-platform WordPress plugin before 6.5.1 does…6.1
• CVE-2024-52810@intlify/shared is a shared library for the intlify project.…6.9
• CVE-2024-52811The ngtcp2 project is an effort to implement IETF QUIC proto…8.2
• CVE-2024-52812LF Edge eKuiper is an internet-of-things data analytics and …5.4
• CVE-2024-52813matrix-rust-sdk is an implementation of a Matrix client-serv…4.3
• CVE-2024-52815Synapse is an open-source Matrix homeserver. Synapse version…5.3
• CVE-2024-52816Adobe Experience Manager versions 6.5.21 and earlier are aff…5.4
• CVE-2024-52817Adobe Experience Manager versions 6.5.21 and earlier are aff…5.4
• CVE-2024-52818Adobe Experience Manager versions 6.5.21 and earlier are aff…5.4
• CVE-2024-5282The wp-affiliate-platform WordPress plugin before 6.5.1 does…6.1
• CVE-2024-52822Adobe Experience Manager versions 6.5.21 and earlier are aff…5.4