CVE-2023-50726
Users with `create` but not `override` privileges can perform local sync in argo-cd
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Users with `create` but not `override` privileges can perform local sync in argo-cd
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
- Record
CVE-2023-50726- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2024-0926
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
- Record
EUVD-2024-0926- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g623-jcgg-mhmm
Users with `create` but not `override` privileges can perform local sync
Impact
"Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git.
An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source.
The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added.
Patches
The bug has been patched in the following versions:
- 2.10.3
- 2.9.8
- 2.8.12
Workarounds
To immediately mitigate the risk of branch protection bypass, remove applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
Branch protection rules and review requirements are a great way to enforce security constraints in a GitOps environment, but they should be just one layer in a multi-layered approach. Make sure your AppProject and RBAC restrictions are as thorough as possible to prevent a review bypass vulnerability from permitting excessive damage.
References
For more information
- Open an issue in the Argo CD issue tracker or discussions
- Join us on Slack in channel #argo-cd
- Record
GHSA-g623-jcgg-mhmm- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-269, CWE-863
- Updated
- 2026-11-02
NVD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
- Record
CVE-2023-50726- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-269, CWE-863
- Updated
- 2026-11-02
OSV
Users with `create` but not `override` privileges can perform local sync in argo-cd
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
- Record
CVE-2023-50726- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVGHSA-g623-jcgg-mhmm
Users with `create` but not `override` privileges can perform local sync
Impact
"Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git.
An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source.
The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added.
Patches
The bug has been patched in the following versions:
- 2.10.3
- 2.9.8
- 2.8.12
Workarounds
To immediately mitigate the risk of branch protection bypass, remove applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
Branch protection rules and review requirements are a great way to enforce security constraints in a GitOps environment, but they should be just one layer in a multi-layered approach. Make sure your AppProject and RBAC restrictions are as thorough as possible to prevent a review bypass vulnerability from permitting excessive damage.
References
For more information
- Open an issue in the Argo CD issue tracker or discussions
- Join us on Slack in channel #argo-cd
- Record
GHSA-g623-jcgg-mhmm- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-269, CWE-863
- Updated
- 2026-11-02
OSVRHSA-2024:1752
Red Hat Security Advisory: GitOps 1.12.1- Argo CD CLI and MicroShift GitOps security update
- Record
RHSA-2024:1752- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-argo-cd-2023-50726 No score
Users with `create` but not `override` privileges can perform local sync in argo-cd
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
- Record
BIT-argo-cd-2023-50726- Updated
- 2026-11-02
OSVGO-2024-2643 No score
Bypass manifest during application creation in github.com/argoproj/argo-cd/v2
An improper validation bug allows users who have create privileges to sync a local manifest during application creation. This allows for bypassing the restriction that the manifests come from some approved git/Helm/OCI source.
- Record
GO-2024-2643- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-cdGo |
1.2.0-rc1 to 1.8.7 | None known |
github.com/argoproj/argo-cd/v2Go |
2.9.0 up to 2.9.8 | 2.9.8 |
github.com/argoproj/argo-cd/v2Go |
2.10.0 up to 2.10.3 | 2.10.3 |
github.com/argoproj/argo-cd/v2Go |
2.0.0-rc3 up to 2.8.12 | 2.8.12 |
argo-cdBitnami |
1.2.0 up to 2.8.12, 2.9.0 up to 2.9.8, 2.10.0 up to 2.10.3 | 2.8.122.9.82.10.3 |
github.com/argoproj/argo-cdGo |
1.2.0-rc1 and later | None known |
github.com/argoproj/argo-cd/v2Go |
2.0.0 up to 2.8.12, 2.9.0 up to 2.9.8, 2.10.0 up to 2.10.3 | 2.8.122.9.82.10.3 |
openshift-gitops-argocd-cliRed Hat:openshift_gitops:1.12::el8 From an advisory covering 5 CVEs |
before 0:1.12.1-5.el8 | 0:1.12.1-5.el8 |
openshift-gitops-argocd-cli-redistributableRed Hat:openshift_gitops:1.12::el8 From an advisory covering 5 CVEs |
before 0:1.12.1-5.el8 | 0:1.12.1-5.el8 |
microshift-gitopsRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
microshift-gitops-release-infoRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
openshift-gitops-argocd-cliRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
openshift-gitops-argocd-cli-redistributableRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50726 is a medium vulnerability (CVSS 6.4) in Argoproj Argo-cd, published March 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in github.com/argoproj/argo-cd/v2 2.9.8.
References
github.com/argoproj/argo-cd/security/advisories/GHSA-g623-jcgg-mhmm
argo-cd.readthedocs.io/en/latest/operator-manual/rbac
nvd.nist.gov/vuln/detail/CVE-2023-50726
Show 34 moreShow less
access.redhat.com/errata/RHSA-2024:1752
docs.openshift.com/gitops/latest/understanding_openshift_gitops/about-redhat-openshift-gitops.html
bugzilla.redhat.com/show_bug.cgi?id=2269479
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1752.json
cve.org/CVERecord?id=CVE-2023-50726