linuxfoundation argo-cd CVE-2021-3557 vulnerability in Linux Foundation and Other Products
Published on February 16, 2022

product logo product logo product logo
A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.

NVD

Weakness Type

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. When a resource is given a permissions setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.


Products Associated with CVE-2021-3557

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-3557 are published in these products:

Linux Foundation Argo Cd
 
Red Hat Openshift Gitops
 
Argoproj Argo Cd
 

Exploit Probability

EPSS
0.18%
Percentile
39.93%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.