Skip to content
Fencer Vulns
high 7.5

CVE-2024-21662 json

Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

published 2024-03-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-0792

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch.

Patch / fix

  • linuxfoundation argo-cd 2.8.13, 2.9.9
  • microshift-gitops openshift gitops 1.12 1.12.1-4.el9
  • openshift-gitops-argocd-cli openshift gitops 1.12 1.12.1-5.el8
  • openshift-gitops-argocd-cli openshift gitops 1.12 1.12.1-4.el9
  • microshift-gitops-release-info openshift gitops 1.12 1.12.1-4.el9
  • openshift-gitops-argocd-cli-redistributable openshift gitops 1.12 1.12.1-5.el8
  • openshift-gitops-argocd-cli-redistributable openshift gitops 1.12 1.12.1-4.el9

red hat advisories RHSA-2024:1752

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-21662 updated cvss 5.4

argo-cd: Bypassing Rate Limit and Brute Force Protection Using Cache Overflow

  • Red Hat Openshift Data Foundation 4 odf4/odr-rhel8-operator
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps 1.10 openshift-gitops-1/dex-rhel8 v1.10.4-1, openshift-gitops-1/argocd-rhel8 v1.10.4-1, openshift-gitops-1/gitops-rhel8 v1.10.4-1, openshift-gitops-1/must-gather-rhel8 v1.10.4-1, openshift-gitops-1/kam-delivery-rhel8 v1.10.4-1, openshift-gitops-1/argo-rollouts-rhel8 v1.10.4-1, +3 more
    fixed: vendor fix RHSA-2024:1700
  • Red Hat OpenShift GitOps 1.11 openshift-gitops-1/dex-rhel8 v1.11.3-2, openshift-gitops-1/argocd-rhel8 v1.11.3-2, openshift-gitops-1/gitops-rhel8 v1.11.3-2, openshift-gitops-1/must-gather-rhel8 v1.11.3-2, openshift-gitops-1/kam-delivery-rhel8 v1.11.3-2, openshift-gitops-1/argo-rollouts-rhel8 v1.11.3-2, +3 more
    fixed: vendor fix RHSA-2024:1697
  • Red Hat OpenShift GitOps 1.12 microshift-gitops 1.12.1-4.el9, openshift-gitops-1/dex-rhel8 v1.12.1-1, openshift-gitops-argocd-cli 1.12.1-4.el9, openshift-gitops-argocd-cli 1.12.1-5.el8, openshift-gitops-1/argocd-rhel8 v1.12.1-1, openshift-gitops-1/argocd-rhel9 v1.12.1-2, +10 more
    fixed: vendor fix RHSA-2024:1753

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • argoproj argo-cd
  • linuxfoundation argo-cd

Classification

Weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.