GHSA-6w87-g839-9wv7: 
vulnerability analysis and mitigation

A moderate severity vulnerability (GHSA-6w87-g839-9wv7) was discovered in Argo CD affecting versions prior to 1.7.14 and 1.8.7. The vulnerability was published on March 8, 2021, and involves the exposure of Helm OCI repository credentials in Argo CD logs. This security issue was identified by an anonymous third-party researcher and received a CVSS score of 6.6 (GitHub Advisory).

The vulnerability is classified under CWE-532 and received a CVSS v3.1 base score of 6.6 with the following metrics: Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, User Interaction: Required, Scope: Unchanged, Confidentiality: High, Integrity: High, and Availability: None. The technical vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (GitHub Advisory).

When Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were exposed in logs. This exposure meant that anyone with access to the pod logs, either through appropriate permissions to the Kubernetes control plane or through third-party log management systems where Argo CD logs were aggregated, could potentially obtain the credentials to the Helm OCI repository (GitHub Advisory).

The vulnerability requires local access and low attack complexity, with low privileges required and user interaction necessary for exploitation. The scope is unchanged, but the potential impact on confidentiality and integrity is high, though there is no impact on availability (GitHub Advisory).

A patch for this vulnerability is available in Argo CD versions v1.8.7 and v1.7.14. Users are strongly recommended to upgrade to the latest patch version and change the credentials used to access the repositories. No alternative workarounds are available (GitHub Advisory).