Skip to content
Fencer Vulns
high 8.8

CVE-2022-1025 json

Argo CD improper access control bug can allow malicious user to escalate privileges to admin level

published 2022-03-24 4 y ago modified 2026-07-08 4 mo ago also CVE-2022-24768 , GHSA-2f5v-8r3f-8pww , GHSA-96jv-vj39-x4j6 , GO-2022-0359 , GO-2022-0516 , EUVD-2022-6302

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

Patch / fix

  • go github.com/argoproj/argo-cd 2.1.14, 2.2.8, 2.3.2
  • go github.com/argoproj/argo-cd/v2 2.1.14, 2.2.8, 2.3.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1025 updated cvss 8.8

Openshift-Gitops: Improper access control allows admin privilege escalation

  • Red Hat OpenShift GitOps 1.2 openshift-gitops-1/argocd-rhel8 v1.2.3-3
    fixed: vendor fix RHSA-2022:1039
  • Red Hat OpenShift GitOps 1.3 openshift-gitops-1/argocd-rhel8 v1.3.5-4, openshift-gitops-1/argocd-rhel8 v1.3.6-3
    fixed: vendor fix RHSA-2022:1040
  • Red Hat OpenShift GitOps 1.4 openshift-gitops-1/argocd-rhel8 v1.4.4-6
    fixed: vendor fix RHSA-2022:1041
  • Red Hat OpenShift GitOps 1.2 openshift-gitops-1/gitops-rhel8 v1.2.3-3, openshift-gitops-1/kam-delivery-rhel8 v1.2.3-3, openshift-gitops-1/applicationset-rhel8 v1.2.3-3, openshift-gitops-1/gitops-rhel8-operator v1.2.3-3, openshift-gitops-1/gitops-operator-bundle v1.2.3-3 Red Hat OpenShift GitOps 1.3 openshift-gitops-1/dex-rhel8 v1.3.5-4, openshift-gitops-1/dex-rhel8 v1.3.6-3, openshift-gitops-1/gitops-rhel8 v1.3.5-4, openshift-gitops-1/gitops-rhel8 v1.3.6-3, openshift-gitops-1/kam-delivery-rhel8 v1.3.5-4, openshift-gitops-1/kam-delivery-rhel8 v1.3.6-3, +6 more Red Hat OpenShift GitOps 1.4 openshift-gitops-1/dex-rhel8 v1.4.4-6, openshift-gitops-1/gitops-rhel8 v1.4.4-6, openshift-gitops-1/kam-delivery-rhel8 v1.4.4-6, openshift-gitops-1/applicationset-rhel8 v1.4.4-6, openshift-gitops-1/gitops-rhel8-operator v1.4.4-6, openshift-gitops-1/gitops-operator-bundle v1.4.4-6
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/argoproj/argo-cd
>=0.5.0, <=1.8.7
>=0.5.0, <2.1.14
>=2.2.0, <2.2.8
>=2.3.0, <2.3.2
>=0.5.0
2.1.14
2.2.8
2.3.2
go github.com/argoproj/argo-cd/v2
<2.1.14
>=2.2.0, <2.2.8
>=2.3.0, <2.3.2
2.1.14
2.2.8
2.3.2

Affected products

  • n/a ArgoCD

Classification

Weakness
  • CWE-284 Improper Access Control
  • CWE-1220 Insufficient Granularity of Access Control
  • CWE-863 Incorrect Authorization
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-269 Improper Privilege Management
  • CWE-862 Missing Authorization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.