CVE-2022-1025

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-12 · updated 2026-06-17
Weakness: CWE-284

Description

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

Affected products

argoproj argo-cd: from 0.5.0 through 2.1.12; from 2.2.0 through 2.2.7; from 2.3.0 through 2.3.1

References

https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww

Get alerted when CVE-2022-1025 or the next vulnerability affects your stack