Back to Database
Status published
Medium
CVE-2024-31990
Argo CD' API server does not enforce project sourceNamespaces
Vulnerability Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-31990
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c
- https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c
- https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5
- https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17
More from argoproj
View All →CVE-2025-66626
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
High
8.1
CVE-2025-62157
Argo Workflows exposes artifact repository credentials in workflow-controller logs
High
8.5
CVE-2025-62156
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
High
8.1
CVE-2025-59538
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
High
7.5
CVE-2025-59537
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
High
7.5
Affected Vendor
argoproj
View all reports →Affected Software
argo-cd
Vulnerable Versions:
>= 2.10.0, < 2.10.7, >= 2.9.0, < 2.9.12, >= 2.4.0, < 2.8.16
Timeline
Official Publish:
April 15th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H