CVE-2020-8828

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-1188

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://argoproj.github.io/argo-cd/security_considerations/Vendor Advisory
https://github.com/argoproj/argo/releasesThird Party Advisory
https://www.soluble.ai/blog/argo-cves-2020Exploit, Third Party Advisory
https://argoproj.github.io/argo-cd/security_considerations/Vendor Advisory
https://github.com/argoproj/argo/releasesThird Party Advisory
https://www.soluble.ai/blog/argo-cves-2020Exploit, Third Party Advisory

Timeline

Published: Apr 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-88298.8CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis.CVE-2020-88308.8CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA CVE-2020-88315.5Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory doe CVE-2020-88325.5The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context swi CVE-2020-88334.7Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation CVE-2020-88346.5KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{sa CVE-2020-88357.8In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit opera CVE-2020-88386.4An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and CVE-2020-88396.1Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.CVE-2020-88409.8FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi CVE-2020-88418.8An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to auth CVE-2020-88437.4An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer po