Use of a broken or risky cryptographic algorithm in Argo CD - CVE-2024-31989
Published: May 21, 2024 / Updated: May 2, 2026
Vulnerability identifier: #VU129013
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-31989
CWE-ID: CWE-327
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary deployments and disclose sensitive information.
The vulnerability exists due to use of risky or missing cryptographic algorithms in redis cache entries when processing data read from the redis cache. A remote user can modify the "mfst" or "app|resources-tree" keys to execute arbitrary deployments and disclose sensitive information.
Exploitation requires access to the Redis server on the local network segment, such as from another pod in the same cluster.
Affected software
Argo CD
Red Hat OpenShift GitOps
Red Hat OpenShift GitOps
How to mitigate CVE-2024-31989
Install security update from vendor's website.
Argo CD - addressed in versions 2.8.19, 2.9.15, 2.10.10, 2.11.1
Red Hat OpenShift GitOps - addressed in versions 1.10.6, 1.11.5, 1.12.3
Red Hat OpenShift GitOps - addressed in versions 1.10.6, 1.11.5, 1.12.3