CVE-2020-8828: argoproj argo_cd Improper Authentication
Vulnerability summary
CVE-2020-8828 is a high (CVSS 8.8) Improper Authentication vulnerability in argoproj argo_cd. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 08-04-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.80%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.80% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (soluble.ai)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-1188Initialization of a Resource with an Insecure DefaultThe product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
Affected systems
Argoproj1 product
- argo_cd< 1.5.0
Github.com/argoproj1 product
- argo-cd≤ 1.8.0
2 vendors · 2 products
References
8 links
- github.com/argoproj/argo-cdPACKAGE