Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-8828

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-8828
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 05:19 UTC · Revision 1

Source evidence

CVE-2020-8828

core-osv · Original source

Published 8 Apr 2020, 20:15 UTC

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

osv:CVE-2020-8828
Complete source record
{
  "id": "2aaebda84274fd036d5268682fcbfffa42b16e5499d83eccac508e20aedbce59",
  "url": "https://osv.dev/vulnerability/CVE-2020-8828",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-8828",
    "summary": "As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.",
    "evidence": "osv:CVE-2020-8828",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2020-8828",
      "aliases": [
        "BIT-argo-cd-2020-8828",
        "CVE-2020-8828",
        "GHSA-h8jc-jmrf-9h8f"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/argoproj/argo-cd",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "bdda41046378a855e289b5f1602d5c923a3f914a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.5.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.5.0-rc3",
            "v1.5.0-rc2",
            "v1.5.0-rc1",
            "v0.8.0",
            "v0.7.1",
            "v0.7.0",
            "v0.6.1",
            "v0.6.0",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.5",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.4.0-alpha1",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.0",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8828.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:27.138316373Z",
      "provider": "osv",
      "references": [
        "https://argoproj.github.io/argo-cd/security_considerations/",
        "https://github.com/argoproj/argo/releases",
        "https://www.soluble.ai/blog/argo-cves-2020"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-8828",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 431765,
  "published_at": "2020-04-08T20:15:14.763+00:00"
}