CVE-2022-24730: Path Traversal and Improper Access Control in Argo CD repo-server
Summary
CVE-2022-24730: Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server. Affects github.com/argoproj/argo-cd across 3 version ranges.
>= 1.3.0, < 2.1.11
>= 2.2.0, < 2.2.6
>= 2.3.0-rc1, < 2.3.0
Fixed in 2.1.11, 2.2.6 or 2.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to managing and deploying applications in Kubernetes clusters. The repo-server component of Argo CD is responsible for managing repositories and their contents. It allows users to access and interact with Helm charts and other files stored in the repositories. However, a vulnerability in the repo-server component allows a malicious user with read-only repository access to leak sensitive files from the repo-server.
Vulnerability Detail
The vulnerability in Argo CD repo-server is a combination of path traversal and improper access control. A malicious user who has been granted read-only access to a repository can exploit this vulnerability by crafting an API request to the /api/v1/repositories/{repo_url}/appdetails endpoint. By referencing an out-of-bounds file in the request, the attacker can retrieve the contents of that file as part of the response. This can lead to the leakage of sensitive files from other applications' source repositories or any secrets mounted as files on the repo-server. The attacker needs to know or guess the location of the target file to exploit this vulnerability.
How To Fix
Latest published version: v1.8.7 as of 22 Oct 2026
go get github.com/argoproj/argo-cd@v1.8.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.3.0, < 2.1.112.1.11go get github.com/argoproj/argo-cd@v2.1.11 -
>= 2.2.0, < 2.2.62.2.6go get github.com/argoproj/argo-cd@v2.2.6 -
>= 2.3.0-rc1, < 2.3.02.3.0go get github.com/argoproj/argo-cd@v2.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, to mitigate the risk, it is recommended to follow the mitigation steps mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Argo CD repo-server allows a malicious user to leak sensitive files from the repo-server by exploiting path traversal and improper access control. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of Argo CD and follow the recommended mitigation steps. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to managing and deploying applications in Kubernetes clusters.
The repo-server component of Argo CD is responsible for managing repositories and their contents. It allows users to access and interact with Helm charts and other files stored in the repositories.
The vulnerability is a combination of path traversal and improper access control. A malicious user with read-only repository access can craft an API request to the /api/v1/repositories/{repo_url}/appdetails endpoint to leak sensitive files from the repo-server.
Sensitive files that can be leaked include files from other applications' source repositories (potentially decrypted files) and any secrets mounted as files on the repo-server.
To fix this vulnerability, it is recommended to upgrade to one of the patched versions of Argo CD: v2.3.0, v2.2.6, or v2.1.11. Additionally, follow the mitigation steps mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
