CVE-2024-52799: Argo Workflows Chart: Excessive Privileges in Workflow Role
Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those Pods. If a user can be made to run a malicious template, their whole namespace can be compromised. This affects versions of the argo-workflows Chart that use appVersion: 3.4 and above, which no longer need these permissions for the only available Executor, Emissary. It could also affect users below 3.4 depending on their choice of Executor in those versions. This only affects the Helm Chart and not the upstream manifests. This vulnerability is fixed in 0.44.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52799?
CVE-2024-52799 is classified with high severity due to the potential for arbitrary code execution via excessive privileges.
How do I fix CVE-2024-52799?
To fix CVE-2024-52799, upgrade the Argo Workflows Chart to version 0.44.0 or later.
What systems are affected by CVE-2024-52799?
CVE-2024-52799 affects all versions of Argo Workflows Chart prior to 0.44.0 and versions 3.4 and above.
What are the risks associated with CVE-2024-52799?
The risks associated with CVE-2024-52799 include potential unauthorized access to execute code in any Pod within the same namespace.
Is there a workaround for CVE-2024-52799?
Disabling the workflow-role or limiting its privileges can serve as a temporary workaround until an upgrade can be performed.