{"id":"EUVD-2022-2791","enisaUuid":"fba28742-ae42-3a1a-bd3a-32508741325c","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.","datePublished":"May 20, 2022, 1:55:11 PM","dateUpdated":"Apr 23, 2025, 6:25:13 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.1.15\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.2.9\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.3.4\n","aliases":"CVE-2022-24904\nGHSA-6gcg-hp2x-q54h\n","assigner":"GitHub_M","epss":1.15,"enisaIdProduct":[{"id":"5faf51e5-4adf-3d84-8119-4205c8b8618f","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"0.7.0, \u003c 2.1.15"},{"id":"6584c3f2-646d-303f-a0cf-db801b8ce59b","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.2.0, \u003c 2.2.9"},{"id":"a58e8e8f-d978-3b55-ab79-6fa21ddc23a2","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.3.0, \u003c 2.3.4"}],"enisaIdVendor":[{"id":"d5418600-b4b7-3408-9ca3-ec53f1cf0bb1","vendor":{"name":"argoproj"}}],"enisaIdVulnerability":[{"id":"edda6d45-7134-3a47-8799-e3fe08770d25","vulnerability":{"id":"GHSA-6gcg-hp2x-q54h","description":"Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server","datePublished":"May 23, 2022, 9:13:57 PM","dateUpdated":"May 23, 2022, 9:13:57 PM","baseScore":null,"references":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-24904\nhttps://github.com/argoproj/argo-cd/commit/5e767a4b9e30983330c0fdec322192281a90eb84\nhttps://github.com/argoproj/argo-cd/commit/7357cfdb58a560de70a0538c6e3bef6fe39505ea\nhttps://github.com/argoproj/argo-cd/commit/d36d95dc9f71ec61c1a93794f81ece6d61a0d943\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.1.15\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.2.9\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.3.4\ngithub.com/argoproj/argo-cd\n","enisa_id":"EUVD-2022-2791\n","aliases":"CVE-2022-24904\nGHSA-6gcg-hp2x-q54h\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:01:31 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fe2f5c04-b3ef-3f43-a008-c4f2fc82df72","vulnerability":{"id":"CVE-2022-24904","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD\u0027s repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.","datePublished":"May 20, 2022, 1:55:11 PM","dateUpdated":"Apr 23, 2025, 6:25:13 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.1.15\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.2.9\nhttps://github.com/argoproj/argo-cd/releases/tag/v2.3.4\n","enisa_id":"EUVD-2022-2791\n","assigner":"GitHub_M","epss":1.15,"dataProcessed":"Oct 24, 2026, 7:14:36 AM","vulnerabilityProduct":[{"id":"6c9e1d76-350f-4e37-a984-fb7681ad6c09","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.2.0, \u003c 2.2.9"},{"id":"73a67950-c64c-4a96-b5d9-76a0b4c04720","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.3.0, \u003c 2.3.4"},{"id":"7471b0a6-0201-3b3a-9fcb-6e022de4dac6","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.3.0, \u003c 2.3.4"},{"id":"83a8c1d4-a665-495a-994a-739ca20b6ab4","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"0.7.0, \u003c 2.1.15"},{"id":"eb5d5140-0c46-3605-8680-5f795f733f40","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"0.7.0, \u003c 2.1.15"},{"id":"fcb0425e-38a9-307e-8a5e-b258a6c6a3bd","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.2.0, \u003c 2.2.9"}],"vulnerabilityVendor":[{"id":"4e14c720-cfc7-39dc-97f5-5aa197100529","vendor":{"name":"argoproj"}}]}}],"enisaIdAdvisory":[{"id":"4a95ff9d-c16e-355a-b2cd-1ed5f887a231","advisory":{"id":"RHSA-2022:4692","description":"Red Hat Security Advisory: Red Hat OpenShift GitOps security update","summary":"An update is now available for Red Hat OpenShift GitOps 1.4 in openshift-gitops-argocd container.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"May 18, 2022, 10:05:25 PM","dateUpdated":"Jun 26, 2026, 3:55:42 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2022:4692\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4692.json\n","aliases":"CVE-2022-24904\nCVE-2022-24905\nCVE-2022-29165\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"280ce508-1cbf-32b2-a06f-4ea9720dee4a","product":{"name":"Red Hat OpenShift GitOps 1.4","vendor":{"name":"Red Hat"}}},{"id":"3b85861c-7189-3677-be6c-8f53dbdeaf43","product":{"name":"openshift-gitops-1/argocd-rhel8@sha256:3f55b9686dfa194667db93cd044a71b2e2d52f73ac10f0f99d95197bb4e5f130_amd64","vendor":{"name":"Red Hat"}}},{"id":"858e16ae-65ad-3007-9fb6-e9ac037fdfcf","product":{"name":"openshift-gitops-1/kam-delivery-rhel8@sha256:e371787eefe08695d130b0fd84c81c4bf966be6f1c82222e5c9ae0a8fa45428f_amd64","vendor":{"name":"Red Hat"}}},{"id":"9e089959-539b-3bec-b59c-f1d39da76249","product":{"name":"openshift-gitops-1/gitops-rhel8@sha256:f99ceb45207658527db7e1cf2938a393d876b2431cdc583ea05a2f9cb305e071_amd64","vendor":{"name":"Red Hat"}}},{"id":"bf29cc71-1dca-3622-9ed6-457cba09f845","product":{"name":"openshift-gitops-1/applicationset-rhel8@sha256:e890bd2bbd025a368c7dd0625612ced98d0e11b110b6381fdb0888dac2504728_amd64","vendor":{"name":"Red Hat"}}},{"id":"c43a69b1-6c02-3ddd-9d34-728e81268847","product":{"name":"openshift-gitops-1/gitops-rhel8-operator@sha256:e9b8ac8b2187fcd5c1533f7a8c7c12715bd2cfac7ceac5b750bc510f5bf57fd2_amd64","vendor":{"name":"Red Hat"}}},{"id":"ded0e285-1b0f-36f0-9dc2-9ed57efa7a1e","product":{"name":"openshift-gitops-1/dex-rhel8@sha256:eb39bc1c6907584501efd99ef9a25faaf6737b7ef4377e5c35dc833d4ec93531_amd64","vendor":{"name":"Red Hat"}}},{"id":"e4aa278a-4ce3-3623-9603-15b83ee64755","product":{"name":"openshift-gitops-1/gitops-operator-bundle@sha256:09bb7f98f120c9ceb5cdfc8b6b86f1b290be9c841bf6aa67c91bb3b05367b5b2_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"c7e4f2d4-7729-39e1-bd47-133f92c1df31","advisory":{"id":"RHSA-2022:4691","description":"Red Hat Security Advisory: Red Hat OpenShift GitOps security update","summary":"An update is now available for Red Hat OpenShift GitOps 1.3 in openshift-gitops-argocd container.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"May 18, 2022, 10:05:00 PM","dateUpdated":"Jun 26, 2026, 3:55:40 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2022:4691\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4691.json\n","aliases":"CVE-2022-24904\nCVE-2022-24905\nCVE-2022-29165\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"3805107b-4950-33d1-9db3-1e4519d6ee0a","product":{"name":"Red Hat OpenShift GitOps 1.3","vendor":{"name":"Red Hat"}}},{"id":"69341d24-2ba3-319b-a2ee-be2ea821a71b","product":{"name":"openshift-gitops-1/applicationset-rhel8@sha256:8621918dacdc5d45ed47f8ecc87e178f5e98b550049d2bee2fd7bba0a918327d_amd64","vendor":{"name":"Red Hat"}}},{"id":"7108bb17-e7ac-360d-b196-c0f109e155c1","product":{"name":"openshift-gitops-1/dex-rhel8@sha256:b58f08d8e8c03c9ed044795574e2645848eec6ec987233edcc74f99131cfc83d_amd64","vendor":{"name":"Red Hat"}}},{"id":"9a0de31a-66c1-38ab-bf2d-ba6f2a963b74","product":{"name":"openshift-gitops-1/gitops-operator-bundle@sha256:cf03b9810510a741c56c55f085832de2f8dd324cb21fb27f5085dbbc2e350f4c_amd64","vendor":{"name":"Red Hat"}}},{"id":"9ca646a9-fa77-3aab-8fa0-9d7d6b92cfc5","product":{"name":"openshift-gitops-1/gitops-rhel8-operator@sha256:ea3f6698c273e1bd2c45d931c44a45f01c15ef1ebd24bc969b824019ff690aac_amd64","vendor":{"name":"Red Hat"}}},{"id":"b97db7a7-6b72-3b5c-86d6-b2f5de3da059","product":{"name":"openshift-gitops-1/kam-delivery-rhel8@sha256:ef21fbf7fef28e0552515305394ba1496626353476bdc1ad59282bd54f500e32_amd64","vendor":{"name":"Red Hat"}}},{"id":"c842828d-52d4-3464-91d9-0c6bd2b0d869","product":{"name":"openshift-gitops-1/gitops-rhel8@sha256:aff088cfffc96a75edacd496fccb2bb374130faf1d9d60acf967469eb60a54db_amd64","vendor":{"name":"Red Hat"}}},{"id":"ff8feac6-16fc-3d97-a0b4-c04d19cfd0eb","product":{"name":"openshift-gitops-1/argocd-rhel8@sha256:d38a00c5f807c275dd6830de16899cd51dc7d57b8dd63c0ec5183fa4d28d2a69_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"ed610b53-64f0-3246-af65-c42518e6161b","advisory":{"id":"RHSA-2022:4690","description":"Red Hat Security Advisory: Red Hat OpenShift GitOps security update","summary":"An update is now available for Red Hat OpenShift GitOps 1.5 in openshift-gitops-argocd container.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"May 18, 2022, 9:21:52 PM","dateUpdated":"Jun 26, 2026, 3:55:42 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2022:4690\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4690.json\n","aliases":"CVE-2022-24904\nCVE-2022-24905\nCVE-2022-29165\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0f3835d7-38aa-3b8d-a957-1ea07beee608","product":{"name":"openshift-gitops-1/gitops-operator-bundle@sha256:2420c7de9ade63c11b453730568a64772ca3ec1551b9b5e9ae8bfa2eef2b3cd9_amd64","vendor":{"name":"Red Hat"}}},{"id":"4b7fbb95-ac85-37d5-a166-be8045cc4fc6","product":{"name":"openshift-gitops-1/argocd-rhel8@sha256:87e4957bcecd23fc21fe44d00a6c40b7bdb62afd0c606ca5dfbd8defeeaad83a_amd64","vendor":{"name":"Red Hat"}}},{"id":"75744cc3-cb8a-362c-91ef-1aff05d3155f","product":{"name":"Red Hat OpenShift GitOps 1.5","vendor":{"name":"Red Hat"}}},{"id":"915672b5-ae69-32b0-a6c6-619680e81a7b","product":{"name":"openshift-gitops-1/gitops-rhel8@sha256:969a1b2b159bdd09f44edb3edcaf7ce9928b223f823a4999404ae8f068b006aa_amd64","vendor":{"name":"Red Hat"}}},{"id":"ad1b84f8-cfc8-312a-96a0-90d75336e37a","product":{"name":"openshift-gitops-1/applicationset-rhel8@sha256:a82e54981e175c7ea5e615aef6659be0c8c2bb2042c4ca762f3551244c352a0d_amd64","vendor":{"name":"Red Hat"}}},{"id":"c660a4cc-bf18-31a4-bb9a-5d604fc05f75","product":{"name":"openshift-gitops-1/gitops-rhel8-operator@sha256:e05a6d29b0822647709a521e47584222e5451c0e53940eacf05b7ac9732bae93_amd64","vendor":{"name":"Red Hat"}}},{"id":"c71dee85-bcac-387b-b01f-90529ade8877","product":{"name":"openshift-gitops-1/kam-delivery-rhel8@sha256:df2f63afa7c824ef139fdc44c420f6c1cc1f0986df520ee3b3e4afd02882566e_amd64","vendor":{"name":"Red Hat"}}},{"id":"e6e36e44-6a0b-3a9e-b410-c243206be851","product":{"name":"openshift-gitops-1/dex-rhel8@sha256:6e1df31388b61351e0ecefe05085dcba23f1524f5c8bb59afd8a00d9039310d6_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"fb2b1112-09c4-31ba-aed2-c48ece4e3632","advisory":{"id":"RHSA-2022:4671","description":"Red Hat Security Advisory: Red Hat OpenShift GitOps security update","summary":"An update is now available for Red Hat OpenShift GitOps 1.3 in openshift-gitops-argocd container.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"May 18, 2022, 7:43:12 PM","dateUpdated":"Jun 26, 2026, 3:55:40 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2022:4671\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4671.json\n","aliases":"CVE-2022-24904\nCVE-2022-24905\nCVE-2022-29165\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"49c67ea2-06bf-3956-81d8-1da17f8b90ef","product":{"name":"openshift-gitops-1/gitops-rhel8@sha256:97871502a00aee8f673601da76111cc39a13088517d6e1d07882f0c4cc249ffc_amd64","vendor":{"name":"Red Hat"}}},{"id":"531593e7-133b-3256-861a-a0a9255eb3a2","product":{"name":"openshift-gitops-1/dex-rhel8@sha256:54bb64a4d6e3044d99f534cce1fbbb2053f8880139a98fddb9e405a71c067359_amd64","vendor":{"name":"Red Hat"}}},{"id":"86df225c-17d4-39e5-9bce-3d07b28794ba","product":{"name":"Red Hat OpenShift GitOps 1.3","vendor":{"name":"Red Hat"}}},{"id":"8afe58a1-2f45-346d-a7c5-d10343d86b5a","product":{"name":"openshift-gitops-1/argocd-rhel8@sha256:2c780222e3aeaffb466f04f5948d474921e9f2a3cc217c4dcc7f83ae268b55a1_amd64","vendor":{"name":"Red Hat"}}},{"id":"93e28195-377d-3ad9-8f79-d821fe5dfd65","product":{"name":"openshift-gitops-1/gitops-rhel8-operator@sha256:95e2be5c2578571d6461ec691466c95f5928fc25e97f7161b98b2a9496a22b5b_amd64","vendor":{"name":"Red Hat"}}},{"id":"9d6b83b2-19e8-37c7-a9b5-b6eee4cccc22","product":{"name":"openshift-gitops-1/applicationset-rhel8@sha256:6def698fb89067d2259a34bced9080d3c7b509b711fda795d73f427f9068c1ba_amd64","vendor":{"name":"Red Hat"}}},{"id":"d78b9667-a5cb-35a9-b713-b6763d755f07","product":{"name":"openshift-gitops-1/gitops-operator-bundle@sha256:6cf4377fd2efa8ae4965dae8e6cc7cd7017fd739e43618d6daea61244fe40d47_amd64","vendor":{"name":"Red Hat"}}},{"id":"e06f5cdd-b0d3-3533-8e23-3de8f33d6afc","product":{"name":"openshift-gitops-1/kam-delivery-rhel8@sha256:c1aa038cbdef8e2eadb2fee362249aa85e5678a4367f9bdd4320de63e27ef705_amd64","vendor":{"name":"Red Hat"}}}]}}]}