{"id":"CVE-2024-36106","aliases":["BIT-argo-cd-2024-36106","EUVD-2024-1898","GHSA-3cqf-953p-h5cp","GO-2024-2898"],"status":"published","title":"Argo CD allows authenticated users to enumerate clusters by name","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00408,"percentile":0.3551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209"],"published":"2024-06-06T15:09:36Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","fixed_in":["2.9.17","2.10.12","2.11.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"argo-cd","fixed_in":["2.11.3"],"sources":["osv"]},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","fixed_in":["2.9.17","2.10.12","2.11.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0"},{"fixed":"2.9.17"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.12"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.0"},{"fixed":"2.11.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"2.9.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.0"},{"fixed":"2.10.12"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.17"},{"introduced":"2.10.0"},{"fixed":"2.10.12"},{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}]}],"products":[{"vendor":"argoproj","product":"argo-cd"},{"vendor":"argoproj","product":"argo_cd"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3cqf-953p-h5cp","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/c2647055c261a550e5da075793260f6524e65ad9","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36106","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3cqf-953p-h5cp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36106.json","tags":["advisory"]},{"url":"https://github.com/argoproj/argo-cd","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-36106","title":"Argo CD allows authenticated users to enumerate clusters by name","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.","status":"published","published":"2024-06-06T15:09:36.474Z","modified":"2024-09-03T15:39:17.996Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-1898","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.","status":"published","published":"2024-06-06T15:09:36Z","modified":"2024-09-03T15:39:17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:05.515988Z"}],"ghsa":[{"id":"GHSA-3cqf-953p-h5cp","title":"Argo-cd authenticated users can enumerate clusters by name","description":"### Impact\nIt’s possible for authenticated users to enumerate clusters by name by inspecting error messages:\n\n```\n$ curl -k 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name' -H \"Authorization: \nBearer $token\"\n{\"error\":\"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z\",\"code\":7,\"message\":\"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z\"}⏎                                 \n                                   \n$ curl -k 'https://localhost:8080/api/v1/clusters/does-not-exist?id.type=name' -H \"Authorizati\non: Bearer $token\"\n{\"error\":\"permission denied\",\"code\":7,\"message\":\"permission denied\"}\n```\n\nIt’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters.\n```\ncurl -k 'https://localhost:8080/api/v1/clusters/in-cluster-project?id.type=name' -H \"Authorization: Bearer $token\"\n{\"error\":\"permission denied: clusters, get, default/, sub: alice, iat: 2022-11-04T20:25:44Z\",\"code\":7,\"message\":\"permission denied: clusters, get, default/, sub: alice, iat: 2022-11-04T20:25:44Z\"}\n\ncurl -k 'https://localhost:8080/api/v1/clusters/does-not-exist?id.type=name' -H \"Authorization: Bearer $token\"\n{\"error\":\"permission denied\",\"code\":7,\"message\":\"permission denied\"}\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.3\nv2.10.12\nv2.9.17\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\nCredits\nThis vulnerability was found \u0026 reported by @crenshaw-dev (Michael Crenshaw)\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-06-06T19:04:54Z","modified":"2024-06-06T19:04:56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:37:53.703286Z"}],"nvd":[{"id":"CVE-2024-36106","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.","status":"published","published":"2024-06-06T15:15:45.023Z","modified":"2026-06-17T07:36:07.053Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:10:04.111836Z"}],"osv":[{"id":"CVE-2024-36106","title":"Argo CD allows authenticated users to enumerate clusters by name","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.","status":"published","published":"2024-06-06T15:09:36.474Z","modified":"2026-10-28T02:30:58.372957556Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GHSA-3cqf-953p-h5cp","title":"Argo-cd authenticated users can enumerate clusters by name","description":"### Impact\nIt’s possible for authenticated users to enumerate clusters by name by inspecting error messages:\n\n```\n$ curl -k 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name' -H \"Authorization: \nBearer $token\"\n{\"error\":\"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z\",\"code\":7,\"message\":\"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z\"}⏎                                 \n                                   \n$ curl -k 'https://localhost:8080/api/v1/clusters/does-not-exist?id.type=name' -H \"Authorizati\non: Bearer $token\"\n{\"error\":\"permission denied\",\"code\":7,\"message\":\"permission denied\"}\n```\n\nIt’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters.\n```\ncurl -k 'https://localhost:8080/api/v1/clusters/in-cluster-project?id.type=name' -H \"Authorization: Bearer $token\"\n{\"error\":\"permission denied: clusters, get, default/, sub: alice, iat: 2022-11-04T20:25:44Z\",\"code\":7,\"message\":\"permission denied: clusters, get, default/, sub: alice, iat: 2022-11-04T20:25:44Z\"}\n\ncurl -k 'https://localhost:8080/api/v1/clusters/does-not-exist?id.type=name' -H \"Authorization: Bearer $token\"\n{\"error\":\"permission denied\",\"code\":7,\"message\":\"permission denied\"}\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.3\nv2.10.12\nv2.9.17\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\nCredits\nThis vulnerability was found \u0026 reported by @crenshaw-dev (Michael Crenshaw)\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-06-06T19:04:54Z","modified":"2026-09-10T03:50:14.78801635Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"BIT-argo-cd-2024-36106","title":"Argo CD allows authenticated users to enumerate clusters by name","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.","status":"published","published":"2024-06-08T07:16:17.211Z","modified":"2026-09-08T08:45:47.749116352Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"GO-2024-2898","title":"Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd","description":"Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd","status":"published","published":"2024-06-28T15:28:30Z","modified":"2026-03-03T04:51:51.900514Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}