Most recent entries from all

bdu:2022-04887

EUVD-2026-233915

fkie_cve-2022-31105

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the `oidc.config.rootCA` field in the `argocd-cm` ConfigMap. This mitigation only forces certificate validation when the API server handles login flows. It does not force certificate verification when verifying tokens on API calls.

GHSA-7943-82jg-wmw5 — Argo CD certificate verification is skipped for connections to OIDC providers

Affected: Go: github.com/argoproj/argo-cd

### Impact

All versions of Argo CD starting with v0.4.0 are vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OIDC provider.

(Note: external OIDC provider support was added in v0.11.0. Before that version, the notes below apply only to the bundled Dex instance.)

You are impacted if 1) have SSO enabled and 2) insecure mode is _not_ enabled on the API server. In this case, certificate verification is skipped when connecting to your OIDC provider for the following tasks: verifying auth tokens on API requests and handling SSO login flows. If you are using the bundled Dex instance but have _not_ set the `--dex-server` flag on the API server to an HTTPS address, then certificate verification is not being skipped (because [TLS is not enabled by default for the bundled Dex instance](https://github.com/argoproj/argo-cd/issues/9424)).

Argo CD sends requests to the configured OIDC provider (either the bundled Dex instance or an external provider) to 1) retrieve the [OpenID configuration](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig), 2) to retrieve the OIDC provider's key set (at the location determined by the [OIDC provider's configured `jwks_uri`](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata)), and 3) (during an SSO login) to exchange an authorization code for a token.

(Note: Starting with v2.3.0, certificate verification is _not_ skipped whe…

Most recent entries from all

bdu:2022-04887

EUVD-2026-233915

fkie_cve-2022-31105

GHSA-7943-82jg-wmw5 — Argo CD certificate verification is skipped for connections to OIDC providers

gsd-2022-31105