CVE-2020-8828 Argo CD Insecure default administrative password
Default admin password derived from pod name allows insiders to escalate privileges in Argo CD deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8828?
CVE-2020-8828 is a high-severity vulnerability in Argoproj Argo Cd, published on 8 Apr 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Which versions are affected by CVE-2020-8828?
3 open source packages ship an affected version, including github.com/argoproj/argo-cd and argo-cd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-cd Go | All versions to 1.8.0 | None |
github.com/argoproj/argo-cd Go | All versions to 1.8.0 | None |
argo-cd Bitnami | All versions | 1.5.0 |
Products include Argoproj Argo Cd.
How do I fix CVE-2020-8828?
Apply the vendor's patch.
Is CVE-2020-8828 being exploited?
There is no known exploitation of CVE-2020-8828 in the wild and no public exploit code.
Other vulnerabilities in Argoproj Argo Cd
- CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
- CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled
- CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD
- CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD
- CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
Sources
Also known as BIT-argo-cd-2020-8828, GHSA-h8jc-jmrf-9h8f.