CVE-2022-29165: Argo CD JWT Impersonation Vulnerability
Summary
CVE-2022-29165: Argo CD will blindly trust JWT claims if anonymous access is enabled. Affects github.com/argoproj/argo-cd/v2 across 3 version ranges.
< 2.1.15
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.4
Fixed in 2.1.15, 2.2.9 or 2.3.4, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-29165 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to managing Kubernetes applications and configurations. Argo CD allows users to deploy, manage, and monitor applications in a GitOps manner. The vulnerability in Argo CD allows unauthenticated users to impersonate any Argo CD user or role by exploiting a flaw in the handling of JSON Web Tokens (JWTs). This vulnerability can be exploited if anonymous access to the Argo CD instance is enabled.
Vulnerability Detail
The vulnerability in Argo CD allows an attacker to impersonate any user or role, including the built-in 'admin' account, by sending a specially crafted JWT along with the request. This can be done even if the targeted account is disabled. The attacker does not need an account on the Argo CD instance to exploit this vulnerability. If anonymous access is enabled, the attacker can escalate their privileges and gain cluster admin privileges, allowing them to create, manipulate, and delete any resource on the cluster. The attacker can also exfiltrate data by deploying malicious workloads with elevated privileges, bypassing any redaction of sensitive data enforced by the Argo CD API.
How To Fix
Latest published version: v2.14.21 as of 22 Oct 2026
go get github.com/argoproj/argo-cd/v2@v2.14.21Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.152.1.15go get github.com/argoproj/argo-cd/v2@v2.1.15 -
>= 2.2.0, < 2.2.92.2.9go get github.com/argoproj/argo-cd/v2@v2.2.9 -
>= 2.3.0, < 2.3.42.3.4go get github.com/argoproj/argo-cd/v2@v2.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade to a patched version quickly, you can disable anonymous access to the Argo CD instance. To check if anonymous access is enabled, run the following command:
kubectl get -n argocd cm argocd-cm -o jsonpath='{.data.users\.anonymous\.enabled}'
If the result is 'true', your instance is vulnerable. To disable anonymous access, patch the 'argocd-cm' ConfigMap by either removing the 'users.anonymous.enabled' field or setting it to 'false'.
To set the field to 'false':
kubectl patch -n argocd cm argocd-cm --type=json -p='[{"op":"add", "path":"/data/users.anonymous.enabled", "value":"false"}]'
To remove the field completely:
kubectl patch -n argocd cm argocd-cm --type=json -p='[{"op":"remove", "path":"/data/users.anonymous.enabled"}]'
Disabling anonymous access will mitigate the vulnerability until an upgrade can be performed.
Conclusion
The Argo CD JWT Impersonation vulnerability allows unauthenticated users to impersonate any user or role in an Argo CD instance. This can lead to privilege escalation and unauthorized access to cluster resources. It is crucial to update Argo CD to a patched version or disable anonymous access to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd/v2 →
FAQ
Argo CD is an open-source continuous delivery tool for Kubernetes. It allows users to deploy, manage, and monitor applications in a GitOps manner.
The vulnerability allows unauthenticated users to impersonate any Argo CD user or role, including the 'admin' account. This can lead to privilege escalation and unauthorized access to cluster resources.
No, the attacker does not need an account on the Argo CD instance to exploit this vulnerability.
You can run the following command to check if anonymous access is enabled:
kubectl get -n argocd cm argocd-cm -o jsonpath='{.data.users\.anonymous\.enabled}'
If the result is 'true', anonymous access is enabled.
If upgrading is not feasible immediately, it is recommended to disable anonymous access to the Argo CD instance. Instructions for disabling anonymous access can be found in the 'Workarounds' section above.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd/v2.
