CVE-2020-8828: Argoproj Argo Cd

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

Affected products

• Argoproj Argo Cd: before 1.5.0 (fixed in 1.5.0)

Published 2020-04-08. Last modified 2026-06-17.