CVE-2020-8827 Improper Restriction of Excessive Authentication Attempts in Argo API

What is CVE-2020-8827?

CVE-2020-8827 is a high-severity vulnerability in Argoproj Argo Cd, published on 8 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.

Weakness: CWE-307

Which versions are affected by CVE-2020-8827?

4 open source packages ship an affected version, including github.com/argoproj/argo-cd and argo-cd. It affects 1 product.

Products include Argoproj Argo Cd.

How do I fix CVE-2020-8827?

Upgrade github.com/argoproj/argo-cd to 1.5.1 or later.

Is CVE-2020-8827 being exploited?

There is no known exploitation of CVE-2020-8827 in the wild and no public exploit code.

Other vulnerabilities in Argoproj Argo Cd

• CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials Critical 10.0
• CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled Critical 10.0
• CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD Critical 9.9
• CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD Critical 9.9
• CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss Critical 9.8

All Argoproj Argo Cd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-argo-cd-2020-8827, GHSA-xcqr-9h24-vrgw, GO-2022-0892.