Skip to content
Fencer Intel
medium 4.3

CVE-2022-41354 json

Argo CD authenticated but unauthorized users may enumerate Application names via the API

published 3y ago modified 4mo ago also GHSA-2q5c-qw9c-fmvq , GO-2023-1670 , EUVD-2023-0830

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

Patch / fix

  • go github.com/argoproj/argo-cd/v2 2.4.28, 2.5.16, 2.6.7
  • linuxfoundation argo-cd 2.4.28, 2.5.16, 2.6.7

Is CVE-2022-41354 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-41354 updated cvss 5.3

ArgoCD: Authenticated but unauthorized users may enumerate Application names via the API

  • Red Hat OpenShift GitOps 1.6 openshift-gitops-1/argocd-rhel8 v1.6.6-1
    fixed: vendor fix RHSA-2023:1453
  • Red Hat OpenShift GitOps 1.7 openshift-gitops-1/argocd-rhel8 v1.7.3-4
    fixed: vendor fix RHSA-2023:1454
  • Red Hat OpenShift GitOps 1.8 openshift-gitops-1/argocd-rhel8 v1.8.1-1
    fixed: vendor fix RHSA-2023:1452
  • Red Hat OpenShift GitOps 1.6 openshift-gitops-1/dex-rhel8 v1.6.6-1, openshift-gitops-1/gitops-rhel8 v1.6.6-1, openshift-gitops-1/kam-delivery-rhel8 v1.6.6-1, openshift-gitops-1/gitops-rhel8-operator v1.6.6-1, openshift-gitops-1/gitops-operator-bundle v1.6.6-1 Red Hat OpenShift GitOps 1.7 openshift-gitops-1/dex-rhel8 v1.7.3-4, openshift-gitops-1/gitops-rhel8 v1.7.3-3, openshift-gitops-1/kam-delivery-rhel8 v1.7.3-3, openshift-gitops-1/console-plugin-rhel8 v1.7.3-4, openshift-gitops-1/gitops-rhel8-operator v1.7.3-4, openshift-gitops-1/gitops-operator-bundle v1.7.3-4 Red Hat OpenShift GitOps 1.8 openshift-gitops-1/dex-rhel8 v1.8.1-1, openshift-gitops-1/gitops-rhel8 v1.8.1-1, openshift-gitops-1/kam-delivery-rhel8 v1.8.1-1, openshift-gitops-1/console-plugin-rhel8 v1.8.1-1, openshift-gitops-1/gitops-rhel8-operator v1.8.1-1, openshift-gitops-1/gitops-operator-bundle v1.8.1-1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/argoproj/argo-cd
>=0.5.0, <=1.8.7
>=0.5.0
 no fix listed
go github.com/argoproj/argo-cd/v2
>=2.5.0, <2.5.16
>=2.6.0, <2.6.7
<2.4.28
2.5.16
2.6.7
2.4.28

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.