CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled
Attackers can impersonate any user, including admin, if anonymous access is enabled, gaining full cluster control and data access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29165?
CVE-2022-29165 is a critical authentication bypass vulnerability in Argoproj Argo Cd, published on 20 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate as any Argo CD user or role, including the `admin` user, by sending a specifically crafted JSON Web Token (JWT) along with the request. In order for this vulnerability to be exploited, anonymous access to the Argo CD instance must have been enabled. In a default Argo CD installation, anonymous access is disabled. The vulnerability can be exploited to impersonate as any user or role, including the built-in `admin` account regardless of whether it is enabled or disabled. Also, the attacker does not need an account on the Argo CD instance in order to exploit this. If anonymous access to the instance is enabled, an attacker can escalate their privileges, effectively allowing them to gain the same privileges on the cluster as the Argo CD instance, which is cluster admin in a default installation. This will allow the attacker to create, manipulate and delete any resource on the cluster. They may also exfiltrate data by deploying malicious workloads with elevated privileges, thus bypassing any redaction of sensitive data otherwise enforced by the Argo CD API. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. As a workaround, one may disable anonymous access, but upgrading to a patched version is preferable.
Which versions are affected by CVE-2022-29165?
10 open source packages ship an affected version, including github.com/argoproj/argo-cd/v2 and github.com/argoproj/argo-cd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-cd/v2 Go | All versions | 2.1.15, 2.2.9, 2.3.4 |
github.com/argoproj/argo-cd/v2 Go | All versions | 2.1.15 |
github.com/argoproj/argo-cd/v2 Go | All versions | 2.1.15 |
github.com/argoproj/argo-cd/v2 Go | From 2.2.0 | 2.2.9 |
github.com/argoproj/argo-cd/v2 Go | From 2.2.0 | 2.2.9 |
github.com/argoproj/argo-cd/v2 Go | From 2.3.0 | 2.3.4 |
4 more packages
github.com/argoproj/argo-cd/v2 Go | From 2.3.0 | 2.3.4 |
github.com/argoproj/argo-cd Go | All versions | None |
github.com/argoproj/argo-cd Go | All versions | 2.1.15 |
github.com/argoproj/argo-cd Go | All versions | 2.1.15 |
Products include Argoproj Argo Cd.
How do I fix CVE-2022-29165?
Upgrade github.com/argoproj/argo-cd/v2 to a fixed version for your release line: 2.1.15, 2.2.9 or 2.3.4.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-29165 being exploited?
There is no known exploitation of CVE-2022-29165 in the wild and no public exploit code.
Other vulnerabilities in Argoproj Argo Cd
- CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
- CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD
- CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD
- CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
- CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Sources
Also known as GHSA-r642-gv9p-2wjj, GO-2022-0455.