CVE-2021-26921: Argoproj Argo Cd

Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days.

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.

Affected products

• Argoproj Argo Cd: before 1.7.12 (fixed in 1.7.12); from 1.8.0, before 1.8.4 (fixed in 1.8.4)

Published 2021-02-09. Last modified 2026-06-17.