CVE-2024-37152

7.5 highEPSS 2.3%

High (7.5) in argoproj argo cd. EPSS 2.3% chance of exploitation in the next 30 days. Fixed in github.com/argoproj/argo-cd/v2/server 2.10.12, 2.11.3, 2.9.17.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWEs: CWE-306, CWE-287
Published: 2024-06-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

argoproj:argo_cd

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-87p9-x75h-p4j2	Go	github.com/argoproj/argo-cd/v2/server	>=2.9.3 <2.9.17	2.9.17
GHSA-87p9-x75h-p4j2	Go	github.com/argoproj/argo-cd/v2/server	>=2.10.0 <2.10.12	2.10.12
GHSA-87p9-x75h-p4j2	Go	github.com/argoproj/argo-cd/v2/server	>=2.11.0 <2.11.3	2.11.3
GO-2024-2902	Go	github.com/argoproj/argo-cd	all versions	no fix published
GO-2024-2902	Go	github.com/argoproj/argo-cd/v2	>=2.9.3 <2.9.17 >=2.10.0 <2.10.12 >=2.11.0 <2.11.3	2.9.17, 2.10.12, 2.11.3

References

Check your stack JSON