PT-2024-2562 · Argo Cd · Argo Cd

Crenshaw-Dev · Published 2024-03-13 · Updated 2025-06-02 · CVE-2023-50726

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Argo CD versions 1.2.0-rc1 through 2.10.2 Argo CD versions 1.2.0-rc1 through 2.9.7 Argo CD versions 1.2.0-rc1 through 2.8.11

Description The issue is related to improper validation in Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes. This allows users with create privileges but not override privileges to sync local manifests on app creation, bypassing the restriction that the manifests come from some approved git/Helm/OCI source. The "local sync" feature, which allows developers to temporarily override an Application's manifests with locally-defined manifests, is affected. This feature should generally be limited to highly-trusted users, as it allows the user to bypass any merge protections in git.

Recommendations For Argo CD versions 1.2.0-rc1 through 2.10.2, upgrade to version 2.10.3. For Argo CD versions 1.2.0-rc1 through 2.9.7, upgrade to version 2.9.8. For Argo CD versions 1.2.0-rc1 through 2.8.11, upgrade to version 2.8.12. As a temporary workaround, consider removing applications, create RBAC access to mitigate the risk of branch protection bypass.

Exploit

Fix

Improper Access Control

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-269

CWE-863

Related Identifiers

BDU:2024-02570

BIT-ARGO-CD-2023-50726

CVE-2023-50726

GHSA-G623-JCGG-MHMM

GO-2024-2643

RHSA-2024:1752

Affected Products

Argo Cd

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50726.json · Exploit
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-g623-jcgg-mhmm · Vendor Advisory
• https://github.com/argoproj/argo-cd/commit/3b8f673f06c2d228e01cbc830e5cb57cef008978 · Patch
• https://bdu.fstec.ru/vul/2024-02570 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50726 · Security Note
• https://osv.dev/vulnerability/BIT-argo-cd-2023-50726 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2643 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g623-jcgg-mhmm · Vendor Advisory
• https://github.com/argoproj/argo-cd · Note
• https://twitter.com/CVEnew/status/1768023078385094923 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2023-50726 · Note
• https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac · Note
• https://cybersecurity-help.cz/vdb/SB2024031428 · Note
• https://t.me/cvenotify/124350 · Telegram Post