CVE-2023-23947: Argo CD - Improper Authorization Allows Unauthorized Cluster Secret Updates
Summary
CVE-2023-23947: Users with any cluster secret update access may update out-of-bounds cluster secrets. Affects github.com/argoproj/argo-cd across 4 version ranges.
>= 2.3.0, < 2.3.17
>= 2.4.0, < 2.4.23
>= 2.5.0, < 2.5.11
>= 2.6.0, < 2.6.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to manage and deploy applications to Kubernetes clusters. Argo CD stores cluster access configurations as Kubernetes Secrets. These secrets contain client configurations for connecting to remote clusters and determine the permissions and restrictions for managing resources. Argo CD versions starting from v2.3.0-rc1 are vulnerable to an improper authorization bug.
Vulnerability Detail
The vulnerability allows users with any cluster secret update access to update out-of-bounds cluster secrets. An attacker who can update at least one cluster secret can exploit this vulnerability to escalate privileges, potentially controlling Kubernetes resources, or disrupt Argo CD functionality. The attack requires the attacker to be authenticated with the Argo CD API server and have authorization to update a cluster secret. By crafting a malicious request, the attacker can modify cluster secrets, remove deployment restrictions, modify connection parameters, and change unscoped clusters to be scoped.
How To Fix
Latest published version: v1.8.7 as of 22 Oct 2026
go get github.com/argoproj/argo-cd@v1.8.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.172.3.17go get github.com/argoproj/argo-cd@v2.3.17 -
>= 2.4.0, < 2.4.232.4.23go get github.com/argoproj/argo-cd@v2.4.23 -
>= 2.5.0, < 2.5.112.5.11go get github.com/argoproj/argo-cd@v2.5.11 -
>= 2.6.0, < 2.6.22.6.2go get github.com/argoproj/argo-cd@v2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, there are two workarounds to mitigate the vulnerability. The first workaround is to limit users with cluster update access by modifying the RBAC configuration to revoke all clusters, update access for users who do not require it. The second workaround is to restrict resource management via AppProjects and RBAC. By configuring AppProjects and RBAC restrictions, you can limit the resources that can be managed via Argo CD.
Conclusion
The vulnerability in Argo CD allows unauthorized cluster secret updates, which can lead to privilege escalation and disruption of Argo CD functionality. It is crucial to upgrade to the patched versions or implement the provided workarounds to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
Argo CD is an open-source continuous delivery tool for Kubernetes that provides a declarative approach to manage and deploy applications to Kubernetes clusters.
All Argo CD versions starting from v2.3.0-rc1 are vulnerable to this improper authorization bug.
An attacker can escalate privileges, potentially controlling Kubernetes resources, or disrupt Argo CD functionality by updating out-of-bounds cluster secrets.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Argo CD: v2.6.2, v2.5.11, v2.4.23, or v2.3.17.
Yes, if immediate upgrading is not possible, you can limit users with cluster update access by modifying the RBAC configuration or restrict resource management via AppProjects and RBAC.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
