Token Mismanagement in Argo CD by Argo Project

CVE-2021-26921

What is CVE-2021-26921?

In Argo CD versions prior to 1.8.4, a vulnerability exists where authentication tokens remain valid even if the associated user account is disabled. This oversight can lead to unauthorized access, allowing individuals to continue using the tokens despite their account being inactive. Organizations using affected versions are at risk if user accounts are disabled without revoking their associated tokens, potentially exposing sensitive operations to compromised or malicious actors.

References