{"id":"CVE-2024-31990","aliases":["BIT-argo-cd-2024-31990","EUVD-2024-1062","GHSA-2gvw-w6fj-7m3c","GO-2024-2728"],"status":"published","title":"Argo CD' API server does not enforce project sourceNamespaces","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00445,"percentile":0.38943,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2024-04-15T19:52:55Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","fixed_in":["2.8.16","2.9.12","2.10.7"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"argo-cd","fixed_in":["2.10.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.8.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.12"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.10.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.8.16"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.9.0"},{"fixed":"2.9.12"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.0"},{"fixed":"2.10.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.8.16"},{"introduced":"2.9.0"},{"fixed":"2.9.12"},{"introduced":"2.10.0"},{"fixed":"2.10.7"}]}]}],"products":[{"vendor":"argoproj","product":"argo-cd"},{"vendor":"argoproj","product":"argo_cd"},{"vendor":"kubernetes","product":"argo-cd"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31990","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2gvw-w6fj-7m3c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31990.json","tags":["advisory"]},{"url":"https://github.com/argoproj/argo-cd","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-31990","title":"Argo CD' API server does not enforce project sourceNamespaces","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.\n","status":"published","published":"2024-04-15T19:52:55.718Z","modified":"2024-08-02T01:59:50.786Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-1062","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.\n","status":"published","published":"2024-04-15T19:52:55Z","modified":"2024-08-02T01:59:50Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:50:24.06764Z"}],"ghsa":[{"id":"GHSA-2gvw-w6fj-7m3c","title":"Argo CD's API server does not enforce project sourceNamespaces","description":"### Impact\n\nI can convince the UI to let me do things with an invalid Application.\n1. Admin gives me `p, michael, applications, *, demo/*, allow`, where `demo` can just deploy to the `demo` namespace\n2. Admin gives me AppProject `dev` which reconciles from ns `dev-apps`\n3. Admin gives me `p, michael, applications, sync, dev/*, allow`, i.e. no updating via the UI allowed, gitops-only\n4. I create an Application called `pwn` in `dev-apps` with project dev and sync the app with sources from git\n5. I change the Application’s project to demo via kubectl or gitops (whichever mechanism my admins have given me, because it should be safe)\n6. I use the UI to edit the resource which should only be mutable via gitops\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.10.7 \nv2.9.12 \nv2.8.16\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\n### Credits\nThis vulnerability was found \u0026 reported by @crenshaw-dev (Michael Crenshaw)\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-04-15T20:20:50Z","modified":"2024-04-25T05:02:35Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:37:46.667202Z"}],"nvd":[{"id":"CVE-2024-31990","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.\n","status":"published","published":"2024-04-15T20:15:11.127Z","modified":"2026-06-17T07:29:04.67Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:09:50.299382Z"}],"osv":[{"id":"CVE-2024-31990","title":"Argo CD' API server does not enforce project sourceNamespaces","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.\n","status":"published","published":"2024-04-15T19:52:55.718Z","modified":"2026-10-28T02:30:48.588952417Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-2gvw-w6fj-7m3c","title":"Argo CD's API server does not enforce project sourceNamespaces","description":"### Impact\n\nI can convince the UI to let me do things with an invalid Application.\n1. Admin gives me `p, michael, applications, *, demo/*, allow`, where `demo` can just deploy to the `demo` namespace\n2. Admin gives me AppProject `dev` which reconciles from ns `dev-apps`\n3. Admin gives me `p, michael, applications, sync, dev/*, allow`, i.e. no updating via the UI allowed, gitops-only\n4. I create an Application called `pwn` in `dev-apps` with project dev and sync the app with sources from git\n5. I change the Application’s project to demo via kubectl or gitops (whichever mechanism my admins have given me, because it should be safe)\n6. I use the UI to edit the resource which should only be mutable via gitops\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.10.7 \nv2.9.12 \nv2.8.16\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\n### Credits\nThis vulnerability was found \u0026 reported by @crenshaw-dev (Michael Crenshaw)\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-04-15T20:20:50Z","modified":"2026-08-07T08:12:26.158528849Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"BIT-argo-cd-2024-31990","title":"Argo CD' API server does not enforce project sourceNamespaces","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.","status":"published","published":"2024-04-17T07:16:36.28Z","modified":"2026-09-08T08:45:45.59611626Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"GO-2024-2728","title":"Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd","description":"Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd","status":"published","published":"2024-06-04T15:19:21Z","modified":"2026-08-07T08:12:04.46635741Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}