{"cve":"CVE-2024-21652","nvd":{"published":"2024-03-18T18:15:09.697","modified":"2026-06-17T07:09:55.920","status":"Analyzed","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the brute force login protection mechanism. Not only can they crash the service affecting all users, but they can also make unlimited login attempts, increasing the risk of account compromise. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-307"],"references":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-x32m-mvfj-52xv","https://github.com/argoproj/argo-cd/security/advisories/GHSA-x32m-mvfj-52xv"],"products":["argoproj:argo_cd"],"source":"nvd","synced_at":"2026-10-19T21:46:54.846886191+00:00"},"epss":{"cve":"CVE-2024-21652","score":0.00751,"percentile":0.54992,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-2vgg-9h6w-m454","url":"https://osv.dev/vulnerability/GHSA-2vgg-9h6w-m454","summary":"Bypassing Rate Limit and Brute Force Protection Using Cache Overflow","modified":"2026-08-07T08:12:20.204682432Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":["<2.8.13"],"fixed":["2.8.13"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":[">=2.9.0 <2.9.9"],"fixed":["2.9.9"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":[">=2.10.0 <2.10.4"],"fixed":["2.10.4"]}]},{"id":"GHSA-x32m-mvfj-52xv","url":"https://osv.dev/vulnerability/GHSA-x32m-mvfj-52xv","summary":"Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss","modified":"2026-08-07T08:12:19.844646241Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":["<2.8.13"],"fixed":["2.8.13"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":[">=2.9.0 <2.9.9"],"fixed":["2.9.9"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":[">=2.10.0 <2.10.4"],"fixed":["2.10.4"]}]},{"id":"GO-2024-2652","url":"https://osv.dev/vulnerability/GO-2024-2652","summary":"Brute force protection bypass in github.com/argoproj/argo-cd/v2","modified":"2026-08-07T08:12:10.904207441Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":["<2.8.13",">=2.9.0 <2.9.9",">=2.10.0 <2.10.4"],"fixed":["2.8.13","2.9.9","2.10.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}