CVE-2024-37152Medium· 5.3▾ TwilightPoC availableUnauthenticated Access to sensitive settings in Argo CD
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.3%
Nuclei ×1 (last check)
The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.
Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except passwordPattern.
Patches A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.3 v2.10.12 v2.9.17
github.com/argoproj/argo-cd/v2/server >= 2.9.3, < 2.9.17github.com/argoproj/argo-cd/v2/server >= 2.10.0, < 2.10.12github.com/argoproj/argo-cd/v2/server >= 2.11.0, < 2.11.3Upgrade to a patched release:
github.com/argoproj/argo-cd/v2/server 2.9.17github.com/argoproj/argo-cd/v2/server 2.10.12github.com/argoproj/argo-cd/v2/server 2.11.3Connected by shared product, vendor, weakness, or advisory.
CVE-2022-24348High· 7.7Path traversal and dereference of symlinks in Argo CD
CVE-2026-42880Critical· 9.6ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
CVE-2024-21661High· 7.5Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
CVE-2023-22736High· 8.5Controller reconciles apps outside configured namespaces when sharding is enabled
CVE-2023-40026Medium· 5.0Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
CVE-2025-23216Medium· 6.8Argo CD does not scrub secret values from patch errors