Privilege Escalation Vulnerability in ArgoCD by Argo Project

CVE-2020-8828

Summary

In ArgoCD v1.5.0 and later, the default admin password is derived from the pod name of the argocd-server, creating a predictable password that poses a significant security risk. This vulnerability can be exploited by users with access to the Kubernetes cluster or its logs, potentially allowing malicious insiders to gain elevated privileges. Given that pod names are not inherently secret, this weakness can be easily discovered, making it crucial for organizations to re-evaluate their security measures surrounding ArgoCD deployments.

References