CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD
A malicious user with specific repository or sync permissions can escalate privileges to admin level in Argo CD, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24768?
CVE-2022-24768 is a critical vulnerability in Argoproj Argo Cd, published on 23 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications.
Which versions are affected by CVE-2022-24768?
It affects 1 product.
Products include Argoproj Argo Cd.
How do I fix CVE-2022-24768?
Upgrade to a fixed version.
Is CVE-2022-24768 being exploited?
There is no known exploitation of CVE-2022-24768 in the wild and no public exploit code.
Other vulnerabilities in Argoproj Argo Cd
- CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
- CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled
- CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD
- CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
- CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction