CVE-2024-31989

CVE-2024-31989 affects Argo CD, a GitOps tool for Kubernetes, allowing unprivileged pods in different namespaces to connect to the Redis server on port 6379, potentially due to misconfigured network policies. This critical vulnerability, with a CVSS score of 9.0, enables privilege escalation to cluster controller level or information leakage if strict Redis access controls are not in place. While there is no known active exploitation or public exploit code, the vulnerability has garnered community discussion and media coverage, indicating awareness of its potential impact. Patches are available in versions 2.8.19, 2.9.15, and 2.10.10.