CVE-2022-31105

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the `oidc.config.rootCA` field in the `argocd-cm` ConfigMap. This mitigation only forces certificate validation when the API server handles login flows. It does not force certificate verification when verifying tokens on API calls.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-295 CWE-599

Affected software

Vendor	Product	Versions
argoproj	argo-cd	>= 0.4.0, < 2.2.11; >= 2.3.0, < 2.3.6; >= 2.4.0, < 2.4.5

References

https://github.com/argoproj/argo-cd/releases/tag/v2.3.6Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.4.5Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.3.6Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.4.5Release Notes, Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5Third Party Advisory

Timeline

Published: Jul 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-311069.8Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 ar CVE-2022-311077.5Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible CVE-2022-311086.1Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify CVE-2022-311096.1laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interface CVE-2022-31115.5An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350 CVE-2022-311107.5RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `f CVE-2022-311115.3Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and CVE-2022-311128.2Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server Li CVE-2022-311136.1Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identif CVE-2022-311145.1backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c CVE-2022-311158.8opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was CVE-2022-311167.5UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly dec