CVE-2022-24904: Argo CD Symlink Following Vulnerability
Summary
CVE-2022-24904: Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server. Affects github.com/argoproj/argo-cd/v2 across 3 version ranges.
< 2.1.15
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.4
Fixed in 2.1.15, 2.2.9 or 2.3.4, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-24904 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to managing Kubernetes resources and applications. The vulnerability affects versions of Argo CD starting from v0.7.0. Argo CD's repo-server is vulnerable to a symlink following bug, which allows a malicious user with repository write access to leak sensitive files. This can include manifest files from other applications' source repositories and JSON-formatted secrets mounted as files on the repo-server.
Vulnerability Detail
The vulnerability arises from the ability of a malicious Argo CD user with write access to commit a symlink that points to an out-of-bounds file. Depending on the target file, different levels of information leakage are possible. If the target file is a valid JSON or YAML manifest file and the resource is allowed in the application, the attacker can read the contents of that manifest file. In some versions, the attacker may even read the file contents if the resource is not allowed in the application. If the target file is valid JSON but not a manifest file, the attacker can read the contents of the file. If the target file is not valid JSON or YAML, the attacker may only read partial file contents, usually just the first character. The vulnerability can lead to the exposure of sensitive information.
How To Fix
Latest published version: v2.14.21 as of 22 Oct 2026
go get github.com/argoproj/argo-cd/v2@v2.14.21Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.152.1.15go get github.com/argoproj/argo-cd/v2@v2.1.15 -
>= 2.2.0, < 2.2.92.2.9go get github.com/argoproj/argo-cd/v2@v2.2.9 -
>= 2.3.0, < 2.3.42.3.4go get github.com/argoproj/argo-cd/v2@v2.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are using Argo CD version 2.3.0 or later and do not have any Jsonnet/directory-type applications, you can disable the Jsonnet/directory config management tool to mitigate the vulnerability. This can be done by setting the jsonnet.enable configuration key to false. However, this workaround should only be applied if it aligns with your specific use case.
Conclusion
The Argo CD symlink following vulnerability can lead to the leakage of sensitive files from the repo-server. It is crucial to upgrade to the recommended versions (v2.3.4, v2.2.9, or v2.1.15) to mitigate the vulnerability. Additionally, implementing best practices and following the provided workarounds can further reduce the risk. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd/v2 →
FAQ
All unpatched versions of Argo CD starting from v0.7.0 are vulnerable to this symlink following bug.
Sensitive files that can be leaked include manifest files from other applications' source repositories, potentially decrypted files if a decryption plugin is used, and any JSON-formatted secrets mounted as files on the repo-server.
Upgrading to Argo CD version 2.3.0 or later significantly reduces the risk of leaking out-of-bounds manifest files. Starting from version 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not actively being generated. Upgrading to version 2.3.3, 2.2.8, or 2.1.14 also reduces the risk of leaking the contents of out-of-bounds manifest files. Implementing best practices such as limiting push access to manifest repositories and restricting user access to necessary projects can further mitigate the risk.
No, the vulnerability requires applying the patches included in the recommended Argo CD versions (v2.3.4, v2.2.9, or v2.1.15) to address the symlink following bug.
Yes, if you are using Argo CD version 2.3.0 or later and do not have any Jsonnet/directory-type applications, you can disable the tool by setting the jsonnet.enable configuration key to false.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd/v2.
