TI-2024-14383 Aliases CVE-2024-21662 GHSA-2vgg-9h6w-m454

Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

HIGH 78CWE-307Published 2024-03-18 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-307.

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00838 58th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial argo-cd (argoproj): 2.8.13, 2.9.9, 2.10.4github.com/argoproj/argo-cd/v2 (Go): 2.8.13, 2.9.9, 2.10.4Red Hat: 4 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
argoproj	argo-cd	before 2.8.13; 2.9.0 to before 2.9.9; 2.10.0 to before 2.10.4	2.8.13, 2.9.9, 2.10.4	Patch available	CNA
—	github.com/argoproj/argo-cd/v2 (Go)	before 2.8.13	2.8.13	Patch available	GHSA-2vgg-9h6w-m454
—	github.com/argoproj/argo-cd/v2 (Go)	2.9.0 to before 2.9.9	2.9.9	Patch available	GHSA-2vgg-9h6w-m454
—	github.com/argoproj/argo-cd/v2 (Go)	2.10.0 to before 2.10.4	2.10.4	Patch available	GHSA-2vgg-9h6w-m454

argo-cd Vendorargoproj Affected before 2.8.13; 2.9.0 to before 2.9.9; 2.10.0 to before 2.10.4 Fixed in 2.8.13, 2.9.9, 2.10.4 Patch available CNA
github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected before 2.8.13 Fixed in 2.8.13 Patch available GHSA-2vgg-9h6w-m454
github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.9.0 to before 2.9.9 Fixed in 2.9.9 Patch available GHSA-2vgg-9h6w-m454
github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.10.0 to before 2.10.4 Fixed in 2.10.4 Patch available GHSA-2vgg-9h6w-m454

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:argoproj:argo_cd::::::::	before 2.8.13; 2.9.0 to before 2.9.9; 2.10.0 to before 2.10.4	Vulnerable	argoproj

cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions before 2.8.13; 2.9.0 to before 2.9.9; 2.10.0 to before 2.10.4 Vulnerable ·argoproj

Remediation

Fix · CNA argo-cd (argoproj) Fixed in 2.8.13, 2.9.9, 2.10.4
Fix · GHSA-2vgg-9h6w-m454 github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.8.13 Advisory →
Fix · GHSA-2vgg-9h6w-m454 github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.9.9 Advisory →
Fix · GHSA-2vgg-9h6w-m454 github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.10.4 Advisory →

Red Hat 4 advisories

RHSA-2024:1753 Released 2024-04-10 · Red Hat rating Important
Errata Advisory for Red Hat OpenShift GitOps v1.12.1 security update
- Red Hat OpenShift GitOps 1.12 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
RHSA-2024:1752 Released 2024-04-10 · Red Hat rating Important
GitOps 1.12.1- Argo CD CLI and MicroShift GitOps security update
- Red Hat OpenShift GitOps 1.12 microshift-gitops-1.12.1-4.el9, microshift-gitops-release-info-1.12.1-4.el9, openshift-gitops-argocd-cli-1.12.1-4.el9 +3
RHSA-2024:1700 Released 2024-04-08 · Red Hat rating Important
Errata Advisory for Red Hat OpenShift GitOps v1.10.4 security update
- Red Hat OpenShift GitOps 1.10 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6

Show 1 more Red Hat advisories

RHSA-2024:1697 Released 2024-04-08 · Red Hat rating Important
Errata Advisory for Red Hat OpenShift GitOps v1.11.3 security update
- Red Hat OpenShift GitOps 1.11 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Openshift Data Foundation 4	Affected	No fix yet
Red Hat OpenShift GitOps 1.10	Fixed	RHSA-2024:1700
Red Hat OpenShift GitOps 1.11	Fixed	RHSA-2024:1697
Red Hat OpenShift GitOps 1.12	Fixed	RHSA-2024:1752, RHSA-2024:1753

Timeline

2026-10-02 Threatist record created from CVE-2024-21662
2026-10-03 Alias added: GHSA-2vgg-9h6w-m454

References

Exploit 1

https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454

Patch 3

Advisory 2

Other 1

https://github.com/argoproj/argo-cd

TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
TI-2024-21088 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVSS 3.1CRITICAL 9.1
TI-2026-33475 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CVSS 3.1HIGH 8.7
TI-2025-37068 Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook CVSS 3.1HIGH 7.5

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences