CVE-2024-37152: medium-severity vulnerability in argoproj argo-cd
Unauthenticated Access to sensitive settings in Argo CD
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 5.3epss 2.3%
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
argoproj · argo-cdRelated CVEs — argoproj argo-cd
In the same product, most dangerous first.
CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 10.6%CVE-2025-55190CRITICALArgo CD: Project API Token Exposes Repository CredentialsEPSS 5.7%CVE-2022-29165CRITICALArgo CD will blindly trust JWT claims if anonymous access is enabledEPSS 2.1%CVE-2026-55797HIGHArgo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLEPSS 1.9%CVE-2024-31989CRITICALArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis CacheEPSS 1.5%CVE-2023-40584MEDIUMDenial of Service to Argo CD repo-server EPSS 1.4%