Low severity · published Nov 22, 2024
CVE-2024-52814
Helm Lacks Granularity in Workflow Role
2.8
CVSS
0.2%
EPSS
No
On KEV
Description
Argo Helm is a collection of community maintained charts for `argoproj.github.io` projects. Prior to version 0.45.0, the `workflow-role`) lacks granularity in its privileges, giving permissions to `workflowtasksets` and `workflowartifactgctasks` to all workflow Pods, when only certain types of Pods created by the Controller require these privileges. The impact is minimal, as an attack could only affect status reporting for certain types of Pods and templates. Version 0.45.0 fixes the issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
argo-helm · argoproj
< 0.45.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52814
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52814
github.com
https://github.com/argoproj/argo-helm/blob/2653aef414ab6a5d8617af75f04190a8f7da28dc/charts/argo-workflows/templates/controller/workflow-role.yaml
github.com
https://github.com/argoproj/argo-helm/blob/2653aef414ab6a5d8617af75f04190a8f7da28dc/charts/argo-workflows/templates/controller/workflow-role.yaml#L45-L56
github.com
https://github.com/argoproj/argo-helm/security/advisories/GHSA-h974-w8pg-cx73
github.com
https://github.com/argoproj/argo-workflows/blob/5aac5a8f61f4e8273d04509dffe7d80123ff67f5/manifests/quick-start/base/agent-role.yaml
github.com
https://github.com/argoproj/argo-workflows/blob/5aac5a8f61f4e8273d04509dffe7d80123ff67f5/manifests/quick-start/base/artifactgc-role.yaml
More from argo-helm
8.9
CVE-2026-15416
Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
8.2
CVE-2024-52799
Argo Workflows Chart: Excessive Privileges in Workflow Role
7.6
CVE-2026-62185
Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE
