Critical severity · published May 21, 2024
CVE-2024-31989
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.0
CVSS
1.5%
EPSS
No
On KEV
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Argo CD · Argoproj
before 2.8.19; 2.9.0 before 2.9.15; 2.10.0 before 2.10.10; 2.11.0 before 2.11.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31989
Patch
https://github.com/argoproj/argo-cd/commit/2de0ceade243039c120c28374016c04ff9590d1d
Patch
https://github.com/argoproj/argo-cd/commit/35a7d6c7fa1534aceba763d6a68697f36c12e678
Patch
https://github.com/argoproj/argo-cd/commit/4e2fe302c3352a0012ecbe7f03476b0e07f7fc6c
Patch
https://github.com/argoproj/argo-cd/commit/53570cbd143bced49d4376d6e31bd9c7bd2659ff
Patch
https://github.com/argoproj/argo-cd/commit/6ef7b62a0f67e74b4aac2aee31c98ae49dd95d12
Patch
https://github.com/argoproj/argo-cd/commit/9552034a80070a93a161bfa330359585f3b85f07
More from Argo CD
10.0
CVE-2022-29165
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
CVE-2026-113709
Argo CD: A Kustomize Helm config home can run commands in the repo-server
9.9
CVE-2026-113708
Argo CD: A Kustomize remote ref can run commands in the repo-server
9.9
CVE-2026-113672
Argo CD: A Jsonnet import can read files from the repo-server
9.9
CVE-2026-77459
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
