CVE-2021-3557 Missing authorization in argocd
Unprivileged users can deploy ArgoCD in their namespace to read all cluster resources, including secrets, enabling privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3557?
CVE-2021-3557 is a medium-severity missing authorization vulnerability in Argoproj Argo Cd, published on 16 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.
Weakness: CWE-732
Which versions are affected by CVE-2021-3557?
It affects 2 products.
Products include Argoproj Argo Cd, Redhat Openshift Gitops.
How do I fix CVE-2021-3557?
No fix has been published for CVE-2021-3557 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-3557 being exploited?
There is no known exploitation of CVE-2021-3557 in the wild and no public exploit code.
Other vulnerabilities in Argoproj Argo Cd
- CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
- CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled
- CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD
- CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD
- CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
Sources
Also known as GHSA-8fgv-frq2-3468.