ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2022-24904

Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

Published May 23, 2022 · catalog updated Oct 21, 2026 · Symlink following allows leaking

Last checked Oct 24, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2022-24904. EPSS is 1.15%. Act only if a listed version of Symlink following allows leaking is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Symlink following allows leaking).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium4.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
1.15%
Remediation
Advisory link
Affected products
Go github.com/argoproj/argo-cd/v2

### Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. * If the target file is a valid JSON or YAML manifest file, and the resource is allowed in the Application, the attacker can read the contents of that manifest file. (In versions =v2.3.0 and do not have any Jsonnet/directory-type Applications, [disable the Jsonnet/directory config management tool](https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools). The config key is called since the same build tool is used for both Jsonnet and plain-manifest ("directory") sources. #### Mitigations * Avoid mounting JSON-formatted secrets as files on the repo-server. * Upgrade to >=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink. * Upgrade to >=2.3.3, >=2.2.8, or >= 2.1.14 to significantly reduce the risk of leaking the contents of (but not the existence of) out-of-bounds manifest files. These versions prevent attackers from loading manifests which are not permitted in the Project which governs the Application. #### Best practices which can mitigate risk * Limit who has push access to manifest repositories. * Limit who is allowed to configure new source repositories. * Limit resource kinds and destinations allowed for Projects, and restrict user access to only the necessary Projects. ### Credits This vulnerability was originally discovered as part of the Trail of Bits audit, published March 12, 2021. The behavior was lef

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/argoproj/argo-cd/v20 → 2.1.15
  • Go github.com/argoproj/argo-cd/v22.2.0 → 2.2.9
  • Go github.com/argoproj/argo-cd/v22.3.0 → 2.3.4

How to fix CVE-2022-24904

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2022-24904. EPSS is 1.15%. Act only if a listed version of Symlink following allows leaking is installed.

Which versions are affected?

Compare what you have installed with 0 → 2.1.15, 2.2.0 → 2.2.9, 2.3.0 → 2.3.4. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-59: Link Following; CWE-61. EPSS 1.15%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 23, 2022 · GitHub Advisory Database

    Detected

    ### Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. * If th

  2. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    github.com/argoproj/argo-cd/v2 fixed in 2.1.15; github.com/argoproj/argo-cd/v2 fixed in 2.2.9; github.com/argoproj/argo-cd/v2 fixed in 2.3.4

  3. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    github.com/argoproj/argo-cd/v2 fixed in 2.1.15

  4. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    github.com/argoproj/argo-cd/v2 fixed in 2.2.9

  5. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    github.com/argoproj/argo-cd/v2 fixed in 2.3.4

  6. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. * If th

Sources

References

Freshness

Last verified in this catalog Oct 24, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSOct 24, 2026
  • Go Vulnerability DatabaseOct 23, 2026
  • GitHub Advisory DatabaseOct 22, 2026
  • OpenSSF OSV / OSV ScannerOct 22, 2026
  • CVE.orgOct 21, 2026