Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Argo Workflows Chart lets attackers execute commands in pods

CVE-2024-52799 · published 1 year ago
Summary

In versions of the Argo Workflows setup package (Helm chart) before 0.44.0, the default role is granted permission to open a command line inside any container running in the same group of applications. If an attacker can cause a malicious workflow to run, they could take over those containers; upgrading the chart to version 0.44.0 or later removes this extra permission.

Original advisory text
Argo Workflows Chart: Excessive Privileges in Workflow Role
Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those Pods. If a user can be made to run a malicious template, their whole namespace can be compromised. This affects versions of the argo-workflows Chart that use appVersion: 3.4 and above, which no longer need these permissions for the only available Executor, Emissary. It could also affect users below 3.4 depending on their choice of Executor in those versions. This only affects the Helm Chart and not the upstream manifests. This vulnerability is fixed in 0.44.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-250Execution with Unnecessary Privileges
CWE-1220Insufficient Granularity of Access Control
Timeline
Published21 Nov 2024
Updated29 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-52799 · NVD
CVE-2024-52799 · OSV
GHSA-fgrf-2886-4q7m · GHSA
Track software like this
Free during beta