Riskcovery

CVE-2024-36106

Argo CD allows authenticated users to enumerate clusters by name

State
Published
Severity
4.3 Medium
Published
Jun 6, 2024
Updated
Sep 3, 2024
Reserved
May 20, 2024

Read the record on cve.org

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

ProductVersions
argo-cdargoproj
  • > 0.11.0, < 2.9.17Affected
  • >= 2.10.0, < 2.10.12Affected
  • >= 2.11.0, < 2.11.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.