CVE-2023-22482: Argo CD JWT Audience Claim Verification Bypass
Summary
CVE-2023-22482: JWT audience claim is not verified. Affects github.com/argoproj/argo-cd across 4 version ranges.
>= 1.8.2, < 2.3.14
>= 2.4.0, < 2.4.20
>= 2.5.0, < 2.5.8
>= 2.6.0-rc1, < 2.6.0-rc5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery and GitOps tool for Kubernetes. It provides a declarative approach to managing applications and configurations in a Git repository. Argo CD uses OpenID Connect (OIDC) for authentication and authorization. OIDC providers issue signed tokens that include an 'aud' (audience) claim, specifying the intended audience(s) of the token. However, Argo CD does not verify the audience claim, allowing it to accept tokens intended for other audiences.
Vulnerability Detail
The vulnerability in Argo CD allows certain invalid tokens to be accepted by the API, bypassing proper authorization. If an OIDC provider serves other audiences besides Argo CD, tokens intended for those audiences can be used to gain unauthorized access to Argo CD. This increases the blast radius of a stolen token. The bug has been assigned a CVSS score of 9.0, indicating a critical severity level.
How To Fix
Latest published version: v1.8.7 as of 22 Oct 2026
go get github.com/argoproj/argo-cd@v1.8.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.8.2, < 2.3.142.3.14go get github.com/argoproj/argo-cd@v2.3.14 -
>= 2.4.0, < 2.4.202.4.20go get github.com/argoproj/argo-cd@v2.4.20 -
>= 2.5.0, < 2.5.82.5.8go get github.com/argoproj/argo-cd@v2.5.8 -
>= 2.6.0-rc1, < 2.6.0-rc52.6.0-rc5go get github.com/argoproj/argo-cd@v2.6.0-rc5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability besides upgrading to the patched versions of Argo CD.
Conclusion
The vulnerability in Argo CD allows for improper authorization, accepting certain invalid tokens. It is critical to upgrade to the patched versions of Argo CD to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
Argo CD is an open-source continuous delivery and GitOps tool for Kubernetes.
The vulnerability allows certain invalid tokens to be accepted, potentially granting unauthorized access to Argo CD. It also increases the blast radius of a stolen token.
To fix this vulnerability, upgrade to the patched versions of Argo CD: v2.6.0-rc5, v2.5.8, v2.4.20, or v2.3.14.
No, there are no known workarounds for this vulnerability.
The vulnerability was discovered by Vladimir Pouzanov (@farcaller) from Indeed, who reported it confidentially and worked with the Argo CD team to provide a remedy.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
