CVE-2024-31990 — Argo CD' API server does not enforce project sourceNamespaces
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit r…
Published: 2024-04-15 · CVSS: 4.8 · CVSS 3.1
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7