CVE-2023-23947

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges (potentially controlling Kubernetes resources) or to break Argo CD functionality (by preventing connections to external clusters). A patch for this vulnerability has been released in Argo CD versions 2.6.2, 2.5.11, 2.4.23, and 2.3.17. Two workarounds are available. Either modify the RBAC configuration to completely revoke all `clusters, update` access, or use the `destinations` and `clusterResourceWhitelist` fields to apply similar restrictions as the `namespaces` and `clusterResources` fields.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-239485.5The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is v CVE-2023-239495.4An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.CVE-2023-23956.1A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web CVE-2023-239506.1User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.CVE-2023-239516.1Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application CVE-2023-239529.8Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability.CVE-2023-239537.8Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability.CVE-2023-239545.4Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerability CVE-2023-239558.1Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability CVE-2023-239565.4A user can supply malicious HTML and JavaScript code that will be executed in the client browser CVE-2023-239575.4An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4 CVE-2023-239586.5Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability.