JWT audience claim is not verified
CVE-2023-22482
Key Information:
What is CVE-2023-22482?
Argo CD, a continuous delivery tool for Kubernetes, suffers from a vulnerability that allows improper authorization due to insufficient validation of audience claims in signed tokens from OIDC providers. While it correctly validates the token signature, it does not check whether the token's audience is intended for Argo CD. This oversight allows an attacker to utilize tokens meant for other services, granting them unauthorized access and permissions within Argo CD. Affected users should upgrade to newer versions, as patches have been released in versions 2.6.0-rc3, 2.5.6, 2.4.19, and 2.3.13 to mitigate this risk. No workarounds are available.
Affected Version(s)
argo-cd >= 1.8.2, < 2.3.13 < 1.8.2, 2.3.13
argo-cd >= 2.4.0-rc1, < 2.4.19 < 2.4.0-rc1, 2.4.19
argo-cd >= 2.5.0-rc1, < 2.5.6 < 2.5.0-rc1, 2.5.6