How severe is CVE-2022-24904?

CVE-2022-24904 has a CVSS score of 4.3/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by CVE-2022-24904?

CVE-2022-24904 affects the following packages: github.com/argoproj/argo-cd/v2 (Go), github.com/argoproj/argo-cd/v2 (Go), github.com/argoproj/argo-cd/v2 (Go). Ecosystems affected: Go.

How do I fix CVE-2022-24904?

Update github.com/argoproj/argo-cd/v2 to 2.1.15 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-24904 is resolved across your whole dependency graph.

How do I detect CVE-2022-24904 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/argoproj/argo-cd/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2022-24904 if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is CVE-2022-24904 actively exploited in the wild?

No public exploit code has been indexed for CVE-2022-24904 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2022-24904?

CVE-2022-24904 has an EPSS (Exploit Prediction Scoring System) score of 1.2%, placing it in the 67th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2022-24904?

CVE-2022-24904 is classified as CWE-59 (CWE-59), CWE-61 (CWE-61). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2022-24904 published, and has it been updated?

CVE-2022-24904 was published on May 20, 2022 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

Not in CISA KEV

MEDIUM severity

CVE-2022-24904 — argo-cd

MEDIUMFix: argoproj/argo-cd@5e767a4

CVE-2022-24904 is a medium-severity (CVSS 4.3) CWE-59 vulnerability in github.com/argoproj/argo-cd/v2. A fix is available for github.com/argoproj/argo-cd/v2 — see the affected versions and patch details below.

Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

Also known asGHSA-6gcg-hp2x-q54hGO-2022-0453

Published

May 20, 2022

Updated

Oct 28, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2022-24904.

EPSS Exploitation Probability

via FIRST.org ↗

1.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs67th percentile — riskier than 67% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected

🐹github.com/argoproj/argo-cd/v2🐹github.com/argoproj/argo-cd/v2🐹github.com/argoproj/argo-cd/v2

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server.

A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file.

If the target file is a valid JSON or YAML manifest file, and the resource is allowed in the Application, the attacker can read the contents of that manifest file. (In versions <2.3.2, <2.2.8, and <2.1.14, the attacker may read the files contents even if the resource is not allowed in the Application).
If the target file is valid JSON but is not a manifest file, the attacker may read the contents of the file.
If the target file is not valid JSON or YAML, the attacker may read partial file contents (usually just the first character of the file).

Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server.

Patches

A patch for this vulnerability has been released in the following Argo CD versions:

v2.3.4
v2.2.9
v2.1.15

Workarounds

If you are using >=v2.3.0 and do not have any Jsonnet/directory-type Applications, disable the Jsonnet/directory config management tool. The config key is called jsonnet.enable since the same build tool is used for both Jsonnet and plain-manifest ("directory") sources.

Mitigations

Avoid mounting JSON-formatted secrets as files on the repo-server.
Upgrade to >=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.
Upgrade to >=2.3.3, >=2.2.8, or >= 2.1.14 to significantly reduce the risk of leaking the contents of (but not the existence of) out-of-bounds manifest files. These versions prevent attackers from loading manifests which are not permitted in the Project which governs the Application.

Best practices which can mitigate risk

Limit who has push access to manifest repositories.
Limit who is allowed to configure new source repositories.
Limit resource kinds and destinations allowed for Projects, and restrict user access to only the necessary Projects.

Credits

This vulnerability was originally discovered as part of the Trail of Bits audit, published March 12, 2021. The behavior was left unchanged at the time.

The vulnerability was independently re-discovered by @crenshaw-dev, who contributed the patch. A security audit by Ada Logics independently followed up on the Trail of Bits report around the same time.

References

List of types of Applications, including directory-type
RBAC documentation, showing how to limit repository permissions
Project documentation, showing how to limit allowable resource kinds and destinations

For more information

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/argoproj/argo-cd/v2`	all versions	2.1.15`go get github.com/argoproj/argo-cd/v2@v2.1.15`
🐹Go	`github.com/argoproj/argo-cd/v2`	≥ 2.2.0&&< 2.2.9	2.2.9`go get github.com/argoproj/argo-cd/v2@v2.2.9`
🐹Go	`github.com/argoproj/argo-cd/v2`	≥ 2.3.0&&< 2.3.4	2.3.4`go get github.com/argoproj/argo-cd/v2@v2.3.4`

Affected Products

1 product · 3 configurations

Application

argo cdargoproj

≥ 2.3.0 && < 2.3.4

range

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/argoproj/argo-cd/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/argoproj/argo-cd/v2 to 2.1.15 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-24904 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

Product	Fixed in	Advisory
Red Hat OpenShift GitOps 1.3	`openshift-gitops-1/applicationset-rhel8:v1.3.10-1`	RHSA-2022:4671
Red Hat OpenShift GitOps 1.3	`openshift-gitops-1/applicationset-rhel8:v1.3.9-3`	RHSA-2022:4691
Red Hat OpenShift GitOps 1.4	`openshift-gitops-1/applicationset-rhel8:v1.4.7-2`	RHSA-2022:4692
Red Hat OpenShift GitOps 1.5	`openshift-gitops-1/applicationset-rhel8:v1.5.1-4`	RHSA-2022:4690

Frequently Asked Questions

### Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. * If the target file is a valid JSON or YAML manifest file, and the resource is allowed in the Application, the attacker can read the contents of that manifest file. (In versions <2.3.2, <2.2.8, and <2.1.