GHSA-xcqr-9h24-vrgw BIT-argo-cd-2020-8827 CVE-2020-8827 GO-2022-0892
Improper Restriction of Excessive Authentication Attempts in Argo API
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 2.21%
- Chance of exploitation in the next 30 days. Higher than 82.61% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-307 Improper Restriction of Excessive Authentication Attempts
- Fix
1.5.1- Upgrade github.com/argoproj/argo-cd to this version or later
Description
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
Specific Go Packages Affected
github.com/argoproj/argo-cd/util/cache
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/argoproj/argo-cd | < 1.5.1 |
1.5.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/argoproj/argo-cd Go → 1.5.1
- go
go get github.com/argoproj/argo-cd@v1.5.1 && go mod tidy
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
References
Advisories
Other links
- github.com/argoproj/argo-cd/pull/3369
- github.com/argoproj/argo-cd/pull/3404
- github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1
- argoproj.github.io/argo-cd/operator-manual/user-management
- argoproj.github.io/argo-cd/security_considerations
- github.com/argoproj/argo/releases
- soluble.ai/blog/argo-cves-2020
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks | Critical | Also affects github.com/argoproj/argo-cd |
| GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL | High | Also affects github.com/argoproj/argo-cd |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | High | Also affects github.com/argoproj/argo-cd |
| GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations | Medium | Also affects github.com/argoproj/argo-cd |
| GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction | Critical | Also affects github.com/argoproj/argo-cd |
| GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook | High | Also affects github.com/argoproj/argo-cd |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload | High | Also affects github.com/argoproj/argo-cd |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload | High | Also affects github.com/argoproj/argo-cd |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor