← Vulnerability feed

Vulnerability record · CVE-2024-21652 · published 18 March 2024

CVE-2024-21652: Argoproj argo cd improper restriction of authentication attempts vulnerability

Argoproj · Argo Cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the brute force login protection mechanism. Not only can they crash the service affecting all users, but they can also make unlimited login attempts, increasing the risk of account compromise. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.

9.8 CVSS 3.1 Critical EPSS 0.75% · top 46.9% CWE-307 · Improper restriction of authentication attempts
9.8CVSS 3.1 base score
0.75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the brute force login protection mechanism. Not only can they crash the service affecting all users, but they can also make unlimited login attempts, increasing the risk of account compromise. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/argoproj/argo-cd/security/advisories/GHSA-x32m-mvfj-52xv Vendor Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-x32m-mvfj-52xv Vendor Advisory

Track CVE-2024-21652 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2022-29165Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with versi…EPSS 2.1%9.9CVE-2025-55190Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.…EPSS 5.5%9.6CVE-2026-42880Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a …EPSS 0.56%9.6CVE-2023-40029Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. …EPSS 1.2%9.6CVE-2022-31105Argoproj argo cd improper certificate validation vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 i…EPSS 0.78%9.1CVE-2024-21662Argoproj argo cd improper restriction of authentication attempts vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively by…EPSS 0.84%9.0CVE-2024-31989Argoproj argo cd broken cryptographic algorithm vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on…EPSS 1.5%8.8CVE-2023-22482Argoproj argo cd incorrect authorization vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6…EPSS 0.88%

Source: NIST National Vulnerability Database (record CVE-2024-21652), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.