CVE-2024-36106

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 2.11.3 Argo CD versions prior to 2.10.12 Argo CD versions prior to 2.9.17

Description Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This issue can be exploited by sending requests to specific API endpoints, such as 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name', and analyzing the error messages returned.

Recommendations For versions prior to 2.11.3, update to version 2.11.3 or later. For versions prior to 2.10.12, update to version 2.10.12 or later. For versions prior to 2.9.17, update to version 2.9.17 or later. As a temporary workaround, consider restricting access to the api/v1/clusters endpoint until a patch is applied.