{"id":"CVE-2024-37152","aliases":["GHSA-87p9-x75h-p4j2","BIT-argo-cd-2024-37152","GO-2024-2902"],"title":"Unauthenticated Access to sensitive settings in Argo CD","summary":"Unauthenticated Access to sensitive settings in Argo CD","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"argoproj","product":"github.com/argoproj/argo-cd/v2/server","ecosystem":"go","affected":["github.com/argoproj/argo-cd/v2/server >= 2.9.3, < 2.9.17","github.com/argoproj/argo-cd/v2/server >= 2.10.0, < 2.10.12","github.com/argoproj/argo-cd/v2/server >= 2.11.0, < 2.11.3"],"patched":["github.com/argoproj/argo-cd/v2/server 2.9.17","github.com/argoproj/argo-cd/v2/server 2.10.12","github.com/argoproj/argo-cd/v2/server 2.11.3"],"published":"2024-06-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:14.980997861Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-87p9-x75h-p4j2","references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37152"},{"url":"https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b"},{"url":"https://github.com/argoproj/argo-cd"},{"url":"https://pkg.go.dev/vuln/GO-2024-2902"}],"tags":["osv","go","exploit-available"],"epss":0.02348,"epssPercentile":0.82771,"exploits":{"nuclei":["CVE-2024-37152"],"checkedAt":"2026-09-21T15:26:35.345Z"},"exploitAvailable":true,"ingestedAt":"2026-09-12T03:13:01.766Z","slug":"CVE-2024-37152","body":"## Overview\n\n# Summary\nThe CVE allows unauthorized access to the sensitive settings exposed by  /api/v1/settings endpoint without authentication. \n\n# Details\n## **Unauthenticated Access:**\n\n### Endpoint: /api/v1/settings\nDescription: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except `passwordPattern`. \n\nPatches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.3\nv2.10.12\nv2.9.17\n\n\n# Impact\n## Unauthenticated Access:\n\n* Type: Unauthorized Information Disclosure.\n* Affected Parties: All users and administrators of the Argo CD instance.\n* Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.\n\n\n\n## Affected packages\n\n- `github.com/argoproj/argo-cd/v2/server >= 2.9.3, < 2.9.17`\n- `github.com/argoproj/argo-cd/v2/server >= 2.10.0, < 2.10.12`\n- `github.com/argoproj/argo-cd/v2/server >= 2.11.0, < 2.11.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/argoproj/argo-cd/v2/server 2.9.17`\n- `github.com/argoproj/argo-cd/v2/server 2.10.12`\n- `github.com/argoproj/argo-cd/v2/server 2.11.3`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.2,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[]}