Read the docs
TI-2022-08642 Aliases CVE-2022-24829

Missing authentication in Garden

Priority MEDIUM 46CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api endpoint on the local server that is responsible for serving the Garden dashboard. At the moment, this server is accessible to 0.0.0.0 which makes it accessible to anyone on the same network (or anyone on the internet if they are on a public, static IP). This may lead to the ability to compromise credentials, secrets or environment variables. Users are advised to upgrade to version 0.12.39 as soon as possible. Users unable to upgrade should use a firewall blocking access to port 9777 from all untrusted network machines.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01353 71st percentileScored 2026-11-07
Fix Fixed garden (garden-io): 0.12.39

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
garden-iogardenbefore 0.12.390.12.39Patch availableCNA
  • garden Vendorgarden-io Affected before 0.12.39 Fixed in 0.12.39 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:garden:garden:*:*:*:*:*:kubernetes:*:*before 0.12.39VulnerableGarden
  • cpe:2.3:a:garden:garden:*:*:*:*:*:kubernetes:*:* Versions before 0.12.39 Vulnerable ·Garden

Remediation

  • Fix · CNA garden (garden-io) Fixed in 0.12.39

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24829

References

Patch 1

Advisory 1

  • TI-2023-23898 Arbitrary code execution vulnerability when using shared Kubernetes cluster CVSS 3.1CRITICAL 9.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences