Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges (potentially controlling Kubernetes resources) or to break Argo CD functionality (by preventing connections to external clusters). A patch for this vulnerability has been released in Argo CD versions 2.6.2, 2.5.11, 2.4.23, and 2.3.17. Two workarounds are available. Either modify the RBAC configuration to completely revoke all clusters, update
access, or use the destinations
and clusterResourceWhitelist
fields to apply similar restrictions as the namespaces
and clusterResources
fields.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Argo-cd | Linuxfoundation | 2.3.0 (including) | 2.3.17 (excluding) |
Argo-cd | Linuxfoundation | 2.4.0 (including) | 2.4.23 (excluding) |
Argo-cd | Linuxfoundation | 2.5.0 (including) | 2.5.11 (excluding) |
Argo-cd | Linuxfoundation | 2.6.0 (including) | 2.6.2 (excluding) |
Red Hat OpenShift GitOps 1.5 | RedHat | openshift-gitops-1/argocd-rhel8:v1.5.10-6 | * |
Red Hat OpenShift GitOps 1.6 | RedHat | openshift-gitops-1/argocd-rhel8:v1.6.5-5 | * |
Red Hat OpenShift GitOps 1.7 | RedHat | openshift-gitops-1/argocd-rhel8:v1.7.2-5 | * |
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user’s privileges and any permissions or other access-control specifications that apply to the resource. When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.