Skip to content
Heist/ feed
Back to feed
Critical

Improper access control allows admin privilege escalation in Argo CD

Type: advisorySources: OSV

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2022-1025, CVE-2022-24768
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 03:14 UTC · Revision 1

Source evidence

Improper access control allows admin privilege escalation in Argo CD

core-osv · Original source

Published 23 Mar 2022, 21:20 UTC

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications.

osv:CVE-2022-24768
Complete source record
{
  "id": "cb4a2f4e2edad100563aec1000e0bdcc31591b3534441f858084955b887bf1eb",
  "url": "https://osv.dev/vulnerability/CVE-2022-24768",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Improper access control allows admin privilege escalation in Argo CD",
    "summary": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications.",
    "evidence": "osv:CVE-2022-24768",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2022-24768",
      "aliases": [
        "CVE-2022-1025",
        "CVE-2022-24768",
        "GHSA-2f5v-8r3f-8pww",
        "GHSA-96jv-vj39-x4j6",
        "GO-2022-0359",
        "GO-2022-0516"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/argoproj/argo-cd",
              "type": "GIT",
              "events": [
                {
                  "introduced": "df0e2e4015c4cff4e16c8743df9d62f5ca1bdc24"
                },
                {
                  "fixed": "836cde06baef111fa2d7fe157de5c199b16bcd2b"
                },
                {
                  "introduced": "6da92a8e8103ce4145bb0fe2b7e952be79c9ff0a"
                },
                {
                  "fixed": "93d588c86e9740a5df3e5379a07593de28da0d1a"
                },
                {
                  "introduced": "fe427802293b090f43f91f5839393174df6c3b3a"
                },
                {
                  "fixed": "ecc2af9dcaa12975e654cde8cbbeaffbb315f75c"
                },
                {
                  "fixed": "af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0.5.0"
                      },
                      {
                        "fixed": "2.1.14"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "2.2.0"
                      },
                      {
                        "fixed": "2.2.8"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "2.3.0"
                      },
                      {
                        "fixed": "2.3.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "836cde06baef111fa2d7fe157de5c199b16bcd2b"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.1.14"
                  },
                  {
                    "range": [
                      {
                        "fixed": "93d588c86e9740a5df3e5379a07593de28da0d1a"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.2.8"
                  },
                  {
                    "range": [
                      {
                        "fixed": "ecc2af9dcaa12975e654cde8cbbeaffbb315f75c"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.3.2"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.1.13",
            "v2.2.7",
            "v2.1.12",
            "v2.3.1",
            "v2.1.11",
            "v2.2.6",
            "v2.3.0",
            "v2.1.10",
            "v2.2.5",
            "v2.1.9",
            "v2.2.4",
            "v2.1.8",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.7",
            "v2.1.2",
            "v2.1.6",
            "v2.1.5",
            "v2.1.4",
            "v2.1.3",
            "v2.1.1",
            "v2.1.0",
            "v2.1.0-rc3",
            "v2.1.0-rc2",
            "v2.1.0-rc1",
            "v0.8.0",
            "v0.7.1",
            "v0.7.0",
            "v0.6.1",
            "v0.6.0",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24768.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.832144980Z",
      "provider": "osv",
      "references": [
        "https://github.com/argoproj/argo-cd/releases/tag/v2.1.14",
        "https://github.com/argoproj/argo-cd/releases/tag/v2.2.8",
        "https://github.com/argoproj/argo-cd/releases/tag/v2.3.2",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24768.json",
        "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-24768",
        "https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-200"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24768.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-1025",
        "evidence": "/aliases"
      },
      {
        "value": "CVE-2022-24768",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499914,
  "published_at": "2022-03-23T21:20:11+00:00"
}