CVE-2024-31989

The problem stems from the lack of default enforcement of network policies in environments such as EKS with the VPC CNI plugin — despite installing the latest version of the plugin, it requires manual enablement of appropriate configuration. As a result, Redis listening on port 6379 is accessible to any pod in the cluster, including those outside the proper namespace. An attacker controlling an unprivileged pod can connect to Redis and manipulate its contents or read data stored by Argo CD. This leads to the possibility of taking over permissions at the cluster controller level by modifying data stored in Redis.

An attacker can obtain Kubernetes cluster controller privileges (privilege escalation) or access sensitive data stored in Redis by Argo CD. The vulnerability threatens the confidentiality, integrity, and availability of the entire environment managed by Argo CD.

Update Argo CD to version 2.8.19, 2.9.15, or 2.10.10 according to the branch currently used in the environment. Additionally, it is recommended to manually enable and configure network policies in the Kubernetes cluster to restrict access to Redis port 6379 only to authorized pods.

Argo CD in versions prior to 2.8.19, 2.9.15, and 2.10.10 — affects environments where Redis is not protected by strict network access control mechanisms (no configured network policies).