CVE-2023-50726

Executive Summary

CVE-2023-50726 is an improper authorization vulnerability in Argo CD, a declarative GitOps continuous delivery tool for Kubernetes. The flaw resides in the "local sync" feature, which allows developers to temporarily override an Application's manifests with locally-defined manifests. An improper validation bug permits users with create privileges but not override privileges to sync local manifests during app creation. This bypasses the intended branch protection mechanisms in git, though all other AppProject restrictions remain enforced. The vulnerability was introduced in version 1.2.0-rc1 and has been patched in versions 2.10.3, 2.9.8, and 2.8.12. The CVSS score is 6.4 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

Argo CD is a Go-based application distributed as a container image and via the Argo CD CLI. The vulnerability affects the core server component. Users should verify the integrity of their Argo CD images using signed checksums and ensure they are pulling from trusted registries (e.g., quay.io/argoproj/argocd). The patch is included in the official release tags, and no additional package manager (npm, PyPI, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid Argo CD account with applications, create RBAC permission.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – An attacker can inject arbitrary manifests, potentially deploying malicious workloads.
• Availability (A): Low (L) – The attack could cause service disruption by deploying misconfigured manifests.

Threat Level: Medium. The vulnerability requires authenticated access with specific RBAC permissions, but it can lead to significant integrity compromise. The lack of public exploits and low EPSS score reduce immediate risk, but organizations using Argo CD with permissive RBAC should prioritize patching.

Deep Dive & Mechanics

The "local sync" feature in Argo CD allows developers to temporarily override an Application's manifests with locally-defined manifests during a sync operation. This is intended for debugging or testing purposes, but it bypasses the normal git-based source of truth. The feature is controlled by the applications, override RBAC action.

The bug occurs in the application creation flow. When a user creates a new Application, Argo CD checks if the user has applications, create permission. However, it fails to verify that the user also has applications, override permission when local manifests are provided. This allows a user with only create permission to perform a local sync during app creation, effectively bypassing the branch protection that would normally require manifests to come from an approved git/Helm/OCI source.

The vulnerability is in the server/application/application.go file, specifically in the Create function. The code path for handling local manifests during creation does not call the EnforceRBAC function with the override action. The fix adds an RBAC check for the override action when local manifests are present in the creation request.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func (s *Server) Create(ctx context.Context, q *ApplicationCreateRequest) (*Application, error) {
    // ... RBAC check for create
    if err := s.enf.EnforceClaims(ctx, claims, "applications", "create", app); err != nil {
        return nil, err
    }
    // ... process request, including local manifests
    // Missing: RBAC check for override when local manifests are present
    app, err := s.appstore.Create(ctx, app)
    // ...
}

Patched Code (simplified):

func (s *Server) Create(ctx context.Context, q *ApplicationCreateRequest) (*Application, error) {
    // ... RBAC check for create
    if err := s.enf.EnforceClaims(ctx, claims, "applications", "create", app); err != nil {
        return nil, err
    }
    // Additional RBAC check for override when local manifests are present
    if q.HasLocalManifests() {
        if err := s.enf.EnforceClaims(ctx, claims, "applications", "override", app); err != nil {
            return nil, err
        }
    }
    app, err := s.appstore.Create(ctx, app)
    // ...
}

The key difference is the addition of the EnforceClaims call for the override action when local manifests are detected in the request.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Argo CD instance (version < 2.10.3, < 2.9.8, < 2.8.12).
• A valid user account with applications, create RBAC permission (but not applications, override).

Exploitation Steps:

1. Authenticate to the Argo CD API or CLI.
2. Prepare a local manifest file (e.g., local-deployment.yaml) containing a malicious Kubernetes Deployment.
3. Use the Argo CD CLI or API to create a new Application with the --local flag or equivalent API parameter.

   argocd app create malicious-app --repo https://example.com/repo.git --path ./ --dest-server https://kubernetes.default.svc --dest-namespace default --local ./local-deployment.yaml
   

4. The application will be created and synced using the local manifest, bypassing the git source.
5. The malicious workload will be deployed to the cluster.

API Exploitation (using curl):

curl -k -H "Authorization: Bearer $TOKEN" -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "metadata": { "name": "malicious-app" },
    "spec": {
      "source": { "repoURL": "https://example.com/repo.git", "path": "./" },
      "destination": { "server": "https://kubernetes.default.svc", "namespace": "default" },
      "syncPolicy": { "automated": {} }
    },
    "localManifests": [
      {"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "malicious"}, "spec": {"replicas": 1, "template": {"spec": {"containers": [{"name": "nginx", "image": "nginx:latest"}]}}}}
    ]
  }' \
  https://argocd-server/api/v1/applications

Blue Team

Detection:

• Monitor Argo CD audit logs for application creation events where localManifests is non-empty.
• Alert on users with applications, create but not applications, override RBAC who create applications.
• Review Argo CD RBAC policies to ensure least privilege.

Hunting:

• Query Argo CD API for applications created with local manifests:

  argocd app list -o json | jq '.[] | select(.spec.source.localManifests != null)'
  

• Check for unexpected workloads in namespaces where Argo CD operates.

Mitigation:

• Immediately upgrade to a patched version (2.10.3, 2.9.8, or 2.8.12).
• If upgrade is not possible, remove applications, create RBAC from all users who do not also have applications, override.

Indicators of Compromise (IOCs)

• Log Entries: Argo CD audit logs showing application creation with localManifests field populated.
• API Calls: POST requests to /api/v1/applications with a localManifests JSON array.
• RBAC Anomalies: Users with applications, create but not applications, override creating applications.
• Kubernetes Resources: Unexpected Deployments, Services, or other resources that do not match the git source of truth.
• Network Traffic: Connections from Argo CD to external registries or repositories not in the approved list.

Detection Engineering

YARA Rule

rule CVE_2023_50726_ArgoCD_LocalSync {
    meta:
        description = "Detects Argo CD application creation requests with local manifests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50726"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $local_manifests = "localManifests"
        $create_endpoint = "/api/v1/applications"
    condition:
        $local_manifests and $create_endpoint
}

Sigma Rule

title: Argo CD Local Sync Privilege Escalation
id: 8c5a2f3e-1b2d-4a3c-9e8f-7d6c5b4a3e2d
status: experimental
description: Detects attempts to exploit CVE-2023-50726 by creating applications with local manifests
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50726
logsource:
    product: argo_cd
    service: audit
detection:
    selection:
        event_type: "application_create"
        request_body|contains: "localManifests"
    condition: selection
falsepositives:
    - Legitimate use by users with override privileges
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-50726 Argo CD Local Sync Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/applications"; http_uri; content:"localManifests"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Argo CD to version 2.10.3, 2.9.8, or 2.8.12 (or later).
2. Review RBAC policies and ensure that only trusted users have applications, create permission.
3. Remove applications, create from users who do not also have applications, override if upgrade is not possible.

Long-term Measures:

• Implement network segmentation to restrict access to the Argo CD API.
• Enable audit logging and monitor for suspicious application creation events.
• Use GitOps best practices: enforce that all manifests must come from approved git repositories.
• Regularly review and audit RBAC permissions.

Workaround: If upgrading is not immediately possible, remove the applications, create RBAC action from all users who do not also have applications, override. This will prevent the exploitation but may impact legitimate workflows.

Valters IT
DevSecOps & Cyber Threat Intelligence