OpenShift GitOps (Argo CD) Swagger UI and OpenAPI schema accessible without authentication

Solution Verified - Updated -

Issue

  • The Argo CD /swagger-ui and /swagger.json endpoints exposed through the openshift gitops route are accessible without authentication. This allows unauthenticated users to browse the API schema and enumerate available Argo CD API endpoints. The behavior was flagged during a penetration test as an information disclosure finding.

Environment

  • Red Hat OpenShift Container Platform

    • 4.18
  • Red Hat OpenShift GitOps Operator

    • 1.19

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content