CVE-2024-31990 Argo CD' API server does not enforce project sourceNamespaces

What is CVE-2024-31990?

CVE-2024-31990 is a medium-severity missing authorization vulnerability in Argoproj Argo Cd, published on 15 Apr 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

Weakness: CWE-863

Which versions are affected by CVE-2024-31990?

9 open source packages ship an affected version, including github.com/argoproj/argo-cd/v2, argo-cd and github.com/argoproj/argo-cd. It affects 1 product.

Products include Argoproj Argo Cd.

How do I fix CVE-2024-31990?

Upgrade github.com/argoproj/argo-cd/v2 to a fixed version for your release line: 2.10.7, 2.8.16 or 2.9.12.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-31990 being exploited?

There is no known exploitation of CVE-2024-31990 in the wild and no public exploit code.

Other vulnerabilities in Argoproj Argo Cd

• CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials Critical 10.0
• CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled Critical 10.0
• CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD Critical 9.9
• CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD Critical 9.9
• CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss Critical 9.8

All Argoproj Argo Cd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-argo-cd-2024-31990, GHSA-2gvw-w6fj-7m3c, GO-2024-2728.