A vulnerability in Argo CD, used by thousands of orgs for deploying applications to Kubernetes, can be leveraged in attacks to disclose sensitive information such as passwords and API keys.
Tracked as CVE-2022-24348, the path-traversal flaw was discovered by the security research team at
Apiiro and can lead to privilege escalation, information disclosure, and lateral movement attacks.
Threat actors can exploit the vulnerability by loading a malicious Kubernetes Helm Chart YAML file onto the target system, allowing the extraction of sensitive information from other applications.
