Back to Database
Status published
Medium
CVE-2024-36106
Argo CD allows authenticated users to enumerate clusters by name
Vulnerability Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-36106
Credits & Attribution
No credits recorded in the NVD database.
References
More from argoproj
View All →CVE-2025-66626
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
High
8.1
CVE-2025-62157
Argo Workflows exposes artifact repository credentials in workflow-controller logs
High
8.5
CVE-2025-62156
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
High
8.1
CVE-2025-59538
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
High
7.5
CVE-2025-59537
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
High
7.5
Affected Vendor
argoproj
View all reports →Affected Software
argo-cd
Vulnerable Versions:
> 0.11.0, < 2.9.17, >= 2.10.0, < 2.10.12, >= 2.11.0, < 2.11.3
Timeline
Official Publish:
June 6th, 2024
Last Modified:
September 3rd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N