Bypassing Rate Limit and Brute Force Protection Using Cache Overflow in github.com/argoproj/argo-cd
Summary
CVE-2024-21652: Bypassing Rate Limit and Brute Force Protection Using Cache Overflow. Affects github.com/argoproj/argo-cd/v2 across 3 version ranges.
< 2.8.13
>= 2.9.0, < 2.9.9
>= 2.10.0, < 2.10.4
Fixed in 2.8.13, 2.9.9 or 2.10.4, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2024-21652 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/argoproj/argo-cd is an open-source application that provides continuous deployment for Kubernetes. It allows users to manage and deploy applications to Kubernetes clusters. The application includes a brute force protection mechanism that relies on a cache-based approach to track login attempts for each user. However, this mechanism has a vulnerability that can be exploited to bypass the rate limit and brute force protections.
Vulnerability Detail
The vulnerability allows an attacker to overflow the cache used by the brute force protection mechanism. By bombarding the cache with login attempts for different users, the attacker can push out the failed attempts of the admin account and effectively reset the rate limit for that account. This enables the attacker to perform brute force attacks at an accelerated rate, especially targeting the default admin account. The vulnerability undermines a previously patched CVE (CVE-2020-8827) intended to protect against brute-force attacks.
How To Fix
Latest published version: v2.14.21 as of 22 Oct 2026
go get github.com/argoproj/argo-cd/v2@v2.14.21Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.8.132.8.13go get github.com/argoproj/argo-cd/v2@v2.8.13 -
>= 2.9.0, < 2.9.92.9.9go get github.com/argoproj/argo-cd/v2@v2.9.9 -
>= 2.10.0, < 2.10.42.10.4go get github.com/argoproj/argo-cd/v2@v2.10.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the package to the latest version.
Conclusion
The vulnerability in github.com/argoproj/argo-cd allows attackers to bypass rate limit and brute force protections by exploiting a cache overflow. It is recommended to update the package to version 2.8.13 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd/v2 →
FAQ
github.com/argoproj/argo-cd is an open-source application for continuous deployment to Kubernetes clusters.
The brute force protection mechanism is designed to prevent unauthorized access to user accounts by limiting the number of login attempts within a certain time period.
The cache overflow vulnerability allows an attacker to overflow the cache used by the brute force protection mechanism, effectively resetting the rate limit for the admin account and enabling accelerated brute force attacks.
Yes, this vulnerability has been patched in github.com/argoproj/argo-cd versions 2.8.13 and later.
No, there are no known workarounds for this vulnerability. It is recommended to update the package to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd/v2.
