GHSA-g623-jcgg-mhmm Users with `create` but not `override` privileges can perform local sync

• Go github.com/argoproj/argo-cd: >= 1.2.0-rc1, <= 1.8.7 (no fix yet) • Go github.com/argoproj/argo-cd/v2: >= 2.9.0, < 2.9.8 → fixed in 2.9.8 • Go github.com/argoproj/argo-cd/v2: >= 2.10.0, < 2.10.3 → fixed in 2.10.3 • Go github.com/argoproj/argo-cd/v2: >= 2.0.0-rc3, < 2.8.12 → fixed in 2.8.12

Impact "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have `create` privileges but not `override` privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is _not_ enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. Patches The bug has been patched in the following versions: • 2.10.3 • 2.9.8 • 2.8.12 Workarounds To immediately mitigate the risk of branch protection bypass, remove `applications, create` RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version. Branch protection rules and review requirements are a great way to enforce security constraints in a GitOps environment, but they should be just one layer in a multi-layered approach. Make sure your AppProject and RBAC restrictions are as thorough as possible to prevent a review bypass vulnerability from permitting excessive damage. References • Argo CD RBAC documentation For more information • Open an issue in the Argo CD issue tracker or discussions • Join us on Slack in channel #argo-cd