CVE-2020-8828: High severity argoproj Argo CD vulnerability
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Other sources
In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Workaround:
The recommended mitigation as described in the user documentation is to use SSO integration. The default admin password should only be used for initial configuration and then disabled or at least changed to a more secure password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Argo CD versions 1.8.0 and prior (where the default admin password is set to the argocd-server pod name, and as of v1.5.0), disable the default admin user or at least change the default admin password to a more secure value; use it only for initial configuration.
Argo CD admin user default admin password = disabled or changed from default pod name to a more secure password - Configuration
Use SSO integration as the recommended mitigation per Argo CD user documentation.
Argo CD SSO integration = enabled
Event History
Frequently Asked Questions
What is CVE-2020-8828?
CVE-2020-8828 is a vulnerability in Argo CD versions 1.8.0 and prior, where the default admin password is set to the argocd-server pod name.
What is the severity of CVE-2020-8828?
CVE-2020-8828 has a severity rating of 8.8 (high).
How can CVE-2020-8828 be exploited?
CVE-2020-8828 can be exploited by insiders with access to the cluster or logs, allowing them to abuse the default admin password for privilege escalation.
Who is at risk from CVE-2020-8828?
The most realistic threat for CVE-2020-8828 is a malicious insider with access to the cluster or logs.
How can CVE-2020-8828 be fixed?
To fix CVE-2020-8828, it is recommended to upgrade Argo CD to a version that is not affected by this vulnerability.