Improper access control in Argo CD - CVE-2024-31990
Published: April 15, 2024 / Updated: May 2, 2026
Vulnerability identifier: #VU129003
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-31990
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify application resources outside intended project source namespace restrictions.
The vulnerability exists due to improper access control in the Argo CD API server when handling application updates and UI operations for an invalid Application. A remote user can change an Application's project assignment and then use the UI to edit a resource to modify application resources outside intended project source namespace restrictions.
Exploitation requires an Application to be created in one project and later reassigned to another project through kubectl or GitOps-managed changes.
Affected software
Argo CD
Red Hat OpenShift GitOps
Red Hat OpenShift GitOps
How to mitigate CVE-2024-31990
Install security update from vendor's website.
Argo CD - addressed in versions 2.8.16, 2.9.12, 2.10.7
Red Hat OpenShift GitOps - update to 1.12.2
Red Hat OpenShift GitOps - update to 1.12.2