What is CVE-2022-24904?

CVE-2022-24904 is a medium-severity vulnerability in Argoproj Argo-Cd, classified under Improper Link Resolution Before File Access. CVSS score: 4.3/10. Published 2022-05-20.

How severe is CVE-2022-24904?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Argoproj Argo-Cd

CVE-2022-24904

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.

Published 2022-05-20 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.011 (65.1th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 65.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: +0.000

Affected products

Argoproj Argo-Cd — versions >= 0.7.0, < 2.1.15, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.4
Argoproj Argo Cd

Weakness classification (CWE)

References

github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h (Third Party Advisory, Mitigation)
github.com/argoproj/argo-cd/releases/tag/v2.1.15 (Third Party Advisory, Release Notes)
github.com/argoproj/argo-cd/releases/tag/v2.2.9 (Third Party Advisory, Release Notes)
github.com/argoproj/argo-cd/releases/tag/v2.3.4 (Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2022-24904?: CVE-2022-24904 is a medium-severity vulnerability in Argoproj Argo-Cd, classified under Improper Link Resolution Before File Access. CVSS score: 4.3/10. Published 2022-05-20.
How severe is CVE-2022-24904?: Medium severity. CVSS v3 base score is 4.3 out of 10.