CVE-2024-37152
Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- Record
CVE-2024-37152- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-287, CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2024-1978
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- Record
EUVD-2024-1978- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-87p9-x75h-p4j2
Unauthenticated Access to sensitive settings in Argo CD
Summary
The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.
Details
Unauthenticated Access:
Endpoint: /api/v1/settings
Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except passwordPattern.
Patches A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.3 v2.10.12 v2.9.17
Impact
Unauthenticated Access:
- Type: Unauthorized Information Disclosure.
- Affected Parties: All users and administrators of the Argo CD instance.
- Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.
- Record
GHSA-87p9-x75h-p4j2- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22, CWE-287, CWE-306, CWE-384
- Updated
- 2026-11-02
NVD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- Record
CVE-2024-37152- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-287, CWE-306
- Updated
- 2026-11-02
OSV
Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- Record
CVE-2024-37152- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-287, CWE-306
- Updated
- 2026-11-02
OSVGHSA-87p9-x75h-p4j2
Unauthenticated Access to sensitive settings in Argo CD
Summary
The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.
Details
Unauthenticated Access:
Endpoint: /api/v1/settings
Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except passwordPattern.
Patches A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.3 v2.10.12 v2.9.17
Impact
Unauthenticated Access:
- Type: Unauthorized Information Disclosure.
- Affected Parties: All users and administrators of the Argo CD instance.
- Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.
- Record
GHSA-87p9-x75h-p4j2- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22, CWE-287, CWE-306, CWE-384
- Updated
- 2026-11-02
OSVBIT-argo-cd-2024-37152 No score
Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- Record
BIT-argo-cd-2024-37152- Updated
- 2026-11-02
OSVGO-2024-2902 No score
Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd
Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd
- Record
GO-2024-2902- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-cd/v2/serverGo |
2.9.3 up to 2.9.17 | 2.9.17 |
github.com/argoproj/argo-cd/v2/serverGo |
2.10.0 up to 2.10.12 | 2.10.12 |
github.com/argoproj/argo-cd/v2/serverGo |
2.11.0 up to 2.11.3 | 2.11.3 |
argo-cdBitnami |
2.9.3 up to 2.11.3 | 2.11.3 |
github.com/argoproj/argo-cdGo |
All versions | None known |
github.com/argoproj/argo-cd/v2Go |
2.9.3 up to 2.9.17, 2.10.0 up to 2.10.12, 2.11.0 up to 2.11.3 | 2.9.172.10.122.11.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Argo CD Unauthenticated Access to sensitive setting |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-37152 is a medium vulnerability (CVSS 5.3) in Argoproj Argo Cd, published June 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in github.com/argoproj/argo-cd/v2/server 2.9.17.
References
github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2
nvd.nist.gov/vuln/detail/CVE-2024-37152
pkg.go.dev/vuln/GO-2024-2902