Read the docs
TI-2023-08731 Aliases CVE-2023-22482GHSA-q9hr-j4rf-8fjc

JWT audience claim is not verified

Priority MEDIUM 43CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD _does_ validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD _does not_ validate the audience claim, so it will accept tokens that are not intended for Argo CD. If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's `groups` claim, even though those groups were not intended to be used by Argo CD. This bug also increases the impact of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD. A patch for this vulnerability has been released in versions 2.6.0-rc3, 2.5.6, 2.4.19, and 2.3.13. There are no workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00903 59th percentileScored 2026-11-07
Fix Fixed argo-cd (argoproj): 2.3.13, 2.4.19, 2.5.6 +1github.com/argoproj/argo-cd (Go): 2.3.14, 2.4.20, 2.5.8 +1Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-cd1.8.2 to before 2.3.13; 2.4.0-rc1 to before 2.4.19; 2.5.0-rc1 to before 2.5.6; 2.6.0-rc1 to before 2.6.0-rc32.3.13, 2.4.19, 2.5.6, 2.6.0-rc3Patch availableCNA
—github.com/argoproj/argo-cd (Go)1.8.2 to before 2.3.142.3.14Patch availableGHSA-q9hr-j4rf-8fjc
—github.com/argoproj/argo-cd (Go)2.4.0 to before 2.4.202.4.20Patch availableGHSA-q9hr-j4rf-8fjc
—github.com/argoproj/argo-cd (Go)2.5.0 to before 2.5.82.5.8Patch availableGHSA-q9hr-j4rf-8fjc
—github.com/argoproj/argo-cd (Go)2.6.0-rc1 to before 2.6.0-rc52.6.0-rc5Patch availableGHSA-q9hr-j4rf-8fjc
  • argo-cd Vendorargoproj Affected 1.8.2 to before 2.3.13; 2.4.0-rc1 to before 2.4.19; 2.5.0-rc1 to before 2.5.6; 2.6.0-rc1 to before 2.6.0-rc3 Fixed in 2.3.13, 2.4.19, 2.5.6, 2.6.0-rc3 Patch available CNA
  • github.com/argoproj/argo-cd (Go) Vendor— Affected 1.8.2 to before 2.3.14 Fixed in 2.3.14 Patch available GHSA-q9hr-j4rf-8fjc
  • github.com/argoproj/argo-cd (Go) Vendor— Affected 2.4.0 to before 2.4.20 Fixed in 2.4.20 Patch available GHSA-q9hr-j4rf-8fjc
  • github.com/argoproj/argo-cd (Go) Vendor— Affected 2.5.0 to before 2.5.8 Fixed in 2.5.8 Patch available GHSA-q9hr-j4rf-8fjc
  • github.com/argoproj/argo-cd (Go) Vendor— Affected 2.6.0-rc1 to before 2.6.0-rc5 Fixed in 2.6.0-rc5 Patch available GHSA-q9hr-j4rf-8fjc

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*1.8.2 to before 2.3.14; 2.4.0 to before 2.4.20; 2.5.0 to before 2.5.8Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc1:*:*:*:*:*:*2.6.0 rc1Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc2:*:*:*:*:*:*2.6.0 rc2Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc3:*:*:*:*:*:*2.6.0 rc3Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc4:*:*:*:*:*:*2.6.0 rc4Vulnerableargoproj
  • cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions 1.8.2 to before 2.3.14; 2.4.0 to before 2.4.20; 2.5.0 to before 2.5.8 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc1:*:*:*:*:*:* Versions 2.6.0 rc1 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc2:*:*:*:*:*:* Versions 2.6.0 rc2 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc3:*:*:*:*:*:* Versions 2.6.0 rc3 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc4:*:*:*:*:*:* Versions 2.6.0 rc4 Vulnerable ·argoproj

Remediation

  • Fix · CNA argo-cd (argoproj) Fixed in 2.3.13, 2.4.19, 2.5.6, 2.6.0-rc3
  • Fix · GHSA-q9hr-j4rf-8fjc github.com/argoproj/argo-cd (Go) Fixed in 2.3.14 Advisory →
  • Fix · GHSA-q9hr-j4rf-8fjc github.com/argoproj/argo-cd (Go) Fixed in 2.4.20 Advisory →
  • Fix · GHSA-q9hr-j4rf-8fjc github.com/argoproj/argo-cd (Go) Fixed in 2.5.8 Advisory →
  • Fix · GHSA-q9hr-j4rf-8fjc github.com/argoproj/argo-cd (Go) Fixed in 2.6.0-rc5 Advisory →

Red Hat 3 advisories

  • RHSA-2023:0468 Released 2023-01-25 · Red Hat rating Important
    Red Hat OpenShift GitOps security update
    • Red Hat OpenShift GitOps 1.5 openshift-gitops-1/argocd-rhel8
  • RHSA-2023:0467 Released 2023-01-25 · Red Hat rating Important
    Red Hat OpenShift GitOps security update
    • Red Hat OpenShift GitOps 1.7 openshift-gitops-1/argocd-rhel8
  • RHSA-2023:0466 Released 2023-01-25 · Red Hat rating Important
    Red Hat OpenShift GitOps security update
    • Red Hat OpenShift GitOps 1.6 openshift-gitops-1/argocd-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift GitOps 1.5Fixed RHSA-2023:0468
Red Hat OpenShift GitOps 1.6Fixed RHSA-2023:0466
Red Hat OpenShift GitOps 1.7Fixed RHSA-2023:0467
Not affected: 3 products
  • Red Hat OpenShift GitOps 1.5
  • Red Hat OpenShift GitOps 1.6
  • Red Hat OpenShift GitOps 1.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22482
  2. 2026-10-03 Alias added: GHSA-q9hr-j4rf-8fjc

References

Patch 1

Advisory 1

Other 1

  • TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
  • TI-2024-14383 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVSS 3.1CRITICAL 9.1
  • TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
  • TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
  • TI-2024-21088 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVSS 3.1CRITICAL 9.1
  • TI-2026-33475 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CVSS 3.1HIGH 8.7
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences