Argo CD Insecure default administrative password

CAO 8.8CVE-2020-8828 · BIT-argo-cd-2020-8828 · GHSA-h8jc-jmrf-9h8f · Công bố 08/04/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-8828 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng github.com/argoproj/argo-cd, argo cd (argoproj).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.8%, cao hơn 78.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.5.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/argoproj/argo-cd Go	`≤ 1.8.0`	Chưa có bản vá
argo cd argoproj	`< 1.5.0`	`1.5.0`

Mô tả

In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

Workaround:

The recommended mitigation as described in the user documentation is to use SSO integration. The default admin password should only be used for initial configuration and then disabled or at least changed to a more secure password.

Mô tả của NVD

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.