OpenShift GitOps (Argo CD) Swagger UI and OpenAPI schema accessible without authentication
Issue
- The Argo CD /swagger-ui and /swagger.json endpoints exposed through the openshift gitops route are accessible without authentication. This allows unauthenticated users to browse the API schema and enumerate available Argo CD API endpoints. The behavior was flagged during a penetration test as an information disclosure finding.
Environment
-
Red Hat OpenShift Container Platform
- 4.18
-
Red Hat OpenShift GitOps Operator
- 1.19
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.