CVE-2022-24731: Path Traversal Vulnerability in Argo CD repo-server
Summary
CVE-2022-24731: Path traversal allows leaking out-of-bound files from Argo CD repo-server. Affects github.com/argoproj/argo-cd across 3 version ranges.
>= 1.5.0, < 2.1.11
>= 2.2.0, < 2.2.6
>= 2.3.0-rc1, < 2.3.0
Fixed in 2.1.11, 2.2.6 or 2.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to manage and deploy applications in Kubernetes clusters. The repo-server component of Argo CD is responsible for managing the source code repositories used by applications. It allows users to create and update applications, granting them read/write access to the repository. However, a path traversal vulnerability in Argo CD's repo-server allows a malicious user to leak sensitive files from the repository. This vulnerability affects all unpatched versions of Argo CD starting from v1.5.0.
Vulnerability Detail
The path traversal vulnerability in Argo CD's repo-server allows a malicious user with read/write access to leak sensitive files. By crafting a malicious Helm chart and using it in an application, the attacker can retrieve the contents of any text file on the repo-server. This can include files from other application's source repositories, potentially exposing decrypted files or secrets mounted as files on the repo-server. The attacker needs to know or guess the location of the target file to exploit this vulnerability.
How To Fix
Latest published version: v1.8.7 as of 22 Oct 2026
go get github.com/argoproj/argo-cd@v1.8.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.5.0, < 2.1.112.1.11go get github.com/argoproj/argo-cd@v2.1.11 -
>= 2.2.0, < 2.2.62.2.6go get github.com/argoproj/argo-cd@v2.2.6 -
>= 2.3.0-rc1, < 2.3.02.3.0go get github.com/argoproj/argo-cd@v2.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
While upgrading is the recommended solution, there are some workarounds to mitigate the vulnerability. These include avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting the access of users who can create or update applications. By following these practices, the risk of sensitive file leakage can be reduced.
Conclusion
The path traversal vulnerability in Argo CD's repo-server can lead to the leakage of sensitive files from the repository. It is crucial to upgrade to the patched versions of Argo CD to mitigate this vulnerability. Additionally, following the recommended workarounds can further reduce the risk of file leakage. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
All unpatched versions of Argo CD starting from v1.5.0 are vulnerable to this path traversal vulnerability.
By exploiting this vulnerability, an attacker with read/write access can leak sensitive files from the repo-server. This can include files from other application's source repositories or secrets mounted as files on the repo-server.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Argo CD: v2.3.0, v2.2.6, or v2.1.11.
Yes, there are some workarounds to mitigate the vulnerability. These include avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting the access of users who can create or update applications.
You can refer to the security documentation for the repo-server component of Argo CD. It provides detailed information on securing the git and Helm repositories used by Argo CD.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
