CVE-2022-24768: Improper access control allows admin privilege escalation in Argo CD
Summary
CVE-2022-24768: Improper access control allows admin privilege escalation in Argo CD. Affects github.com/argoproj/argo-cd across 3 version ranges.
>= 0.5.0, < 2.1.14
>= 2.2.0, < 2.2.8
>= 2.3.0, < 2.3.2
Fixed in 2.1.14, 2.2.8 or 2.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to managing and deploying applications to Kubernetes clusters. Argo CD allows users to define applications using Git repositories or Helm charts and provides a web-based UI for managing and monitoring the deployment process. However, a vulnerability in Argo CD allows for improper access control, potentially enabling a malicious user to escalate their privileges to admin-level.
Vulnerability Detail
The vulnerability in Argo CD arises from an improper access control bug. Unpatched versions of Argo CD starting from v1.0.0 are affected. The vulnerability allows an authorized user with push access to an application's source Git or Helm repository, as well as sync and override access to the application, to potentially escalate their privileges to admin-level. Depending on their RBAC privileges, the user can perform various exploits, including modifying resources on the application's destination cluster, deleting resources, viewing resources and logs, and running actions on the destination cluster. Even users with only get access to an application can access events in the destination cluster. The vulnerability existed in earlier versions of Argo CD as well, with limited exploits available. The impact of the vulnerability increases with higher RBAC privileges.
How To Fix
Latest published version: v1.8.7 as of 22 Oct 2026
go get github.com/argoproj/argo-cd@v1.8.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.5.0, < 2.1.142.1.14go get github.com/argoproj/argo-cd@v2.1.14 -
>= 2.2.0, < 2.2.82.2.8go get github.com/argoproj/argo-cd@v2.2.8 -
>= 2.3.0, < 2.3.22.3.2go get github.com/argoproj/argo-cd@v2.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
While upgrading is the only certain way to avoid the vulnerability, there are some mitigations that can limit potential damage until the upgrade is performed. These include limiting push access to application source repositories, limiting sync and override access to applications, limiting repositories available in projects where users have update access, and limiting delete, get, or action access to applications. However, these mitigations are not a substitute for upgrading and should be considered temporary measures.
Conclusion
The vulnerability in Argo CD allows for improper access control, potentially enabling a malicious user to escalate their privileges to admin-level. It is crucial to upgrade to the patched versions of Argo CD to fix the vulnerability. While there are some mitigations available, they should be considered temporary measures. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
All unpatched versions of Argo CD starting from v1.0.0 are vulnerable to this improper access control bug.
Depending on their RBAC privileges, a malicious user can escalate their privileges to admin-level, modify resources on the application's destination cluster, delete resources, view resources and logs, run actions on the destination cluster, and access events in the destination cluster.
While there are some mitigations that can limit potential damage, the only certain way to avoid the vulnerability is to upgrade to the patched versions of Argo CD.
To fix the vulnerability, you should upgrade your Argo CD installation to one of the patched versions: v2.3.2, v2.2.8, or v2.1.14. Refer to the changelog or upgrade instructions specific to your version for more details.
You can refer to the Argo CD RBAC configuration documentation for more information on configuring RBAC in Argo CD.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
