TI-2024-27728 Aliases CVE-2024-41666 GHSA-v8wx-v5jq-qhhw

The Argo CD web terminal session does not handle the revocation of user permissions properly.

MEDIUM 62CWE-269Published 2024-07-24 · Updated 2024-08-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to the user `p, role:myrole, exec, create, */*, allow`, even if the user revokes this permission, the user can still perform operations in the container, as long as the user keeps the terminal view open for a long time. Although the token expiration and revocation of the user are fixed, however, the fix does not address the situation of revocation of only user `p, role:myrole, exec, create, */*, allow` permissions, which may still lead to the leakage of sensitive information. A patch for this vulnerability has been released in Argo CD versions 2.11.7, 2.10.16, and 2.9.21.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00685 52nd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Partial argo-cd (argoproj): 2.9.21, 2.10.16, 2.11.7github.com/argoproj/argo-cd/v2 (Go): 2.9.21, 2.10.16, 2.11.7Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
argoproj	argo-cd	2.6.0 to before 2.9.21; 2.10.0 to before 2.10.16; 2.11.0 to before 2.11.7	2.9.21, 2.10.16, 2.11.7	Patch available	CNA
—	github.com/argoproj/argo-cd/v2 (Go)	2.6.0 to before 2.9.21	2.9.21	Patch available	GHSA-v8wx-v5jq-qhhw
—	github.com/argoproj/argo-cd/v2 (Go)	2.10.0 to before 2.10.16	2.10.16	Patch available	GHSA-v8wx-v5jq-qhhw
—	github.com/argoproj/argo-cd/v2 (Go)	2.11.0 to before 2.11.7	2.11.7	Patch available	GHSA-v8wx-v5jq-qhhw

argo-cd Vendorargoproj Affected 2.6.0 to before 2.9.21; 2.10.0 to before 2.10.16; 2.11.0 to before 2.11.7 Fixed in 2.9.21, 2.10.16, 2.11.7 Patch available CNA
github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.6.0 to before 2.9.21 Fixed in 2.9.21 Patch available GHSA-v8wx-v5jq-qhhw
github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.10.0 to before 2.10.16 Fixed in 2.10.16 Patch available GHSA-v8wx-v5jq-qhhw
github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.11.0 to before 2.11.7 Fixed in 2.11.7 Patch available GHSA-v8wx-v5jq-qhhw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:argoproj:argo_cd::::::::	2.6.0 to before 2.9.21; 2.10.0 to before 2.10.16; 2.11.0 to before 2.11.7	Vulnerable	argoproj

cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.9.21; 2.10.0 to before 2.10.16; 2.11.0 to before 2.11.7 Vulnerable ·argoproj

Remediation

Fix · CNA argo-cd (argoproj) Fixed in 2.9.21, 2.10.16, 2.11.7
Fix · GHSA-v8wx-v5jq-qhhw github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.9.21 Advisory →
Fix · GHSA-v8wx-v5jq-qhhw github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.10.16 Advisory →
Fix · GHSA-v8wx-v5jq-qhhw github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.11.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift GitOps	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2024-41666
2026-10-03 Alias added: GHSA-v8wx-v5jq-qhhw

References

Exploit 2

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-41666

Other 2

TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
TI-2024-14383 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVSS 3.1CRITICAL 9.1
TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
TI-2024-21088 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVSS 3.1CRITICAL 9.1
TI-2026-33475 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CVSS 3.1HIGH 8.7

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences