{"cve":"CVE-2023-22482","nvd":{"published":"2023-01-26T21:18:12.213","modified":"2026-06-17T05:35:33.353","status":"Modified","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3  are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD _does_ validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD _does not_ validate the audience claim, so it will accept tokens that are not intended for Argo CD. If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's `groups` claim, even though those groups were not intended to be used by Argo CD. This bug also increases the impact of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD. A patch for this vulnerability has been released in versions 2.6.0-rc3, 2.5.6, 2.4.19, and 2.3.13. There are no workarounds.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-863"],"references":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc","https://github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc"],"products":["argoproj:argo_cd"],"source":"nvd","synced_at":"2026-10-19T21:37:34.931465858+00:00"},"epss":{"cve":"CVE-2023-22482","score":0.00879,"percentile":0.5909,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q9hr-j4rf-8fjc","url":"https://osv.dev/vulnerability/GHSA-q9hr-j4rf-8fjc","summary":"JWT audience claim is not verified","modified":"2026-09-10T03:49:51.491808297Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","purl":"pkg:golang/github.com/argoproj/argo-cd","ranges":[">=1.8.2 <2.3.14"],"fixed":["2.3.14"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","purl":"pkg:golang/github.com/argoproj/argo-cd","ranges":[">=2.4.0 <2.4.20"],"fixed":["2.4.20"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","purl":"pkg:golang/github.com/argoproj/argo-cd","ranges":[">=2.5.0 <2.5.8"],"fixed":["2.5.8"]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","purl":"pkg:golang/github.com/argoproj/argo-cd","ranges":[">=2.6.0-rc1 <2.6.0-rc5"],"fixed":["2.6.0-rc5"]}]},{"id":"GO-2023-1520","url":"https://osv.dev/vulnerability/GO-2023-1520","summary":"JWT audience claim is not verified in github.com/argoproj/argo-cd","modified":"2026-03-03T04:53:15.633345Z","packages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","purl":"pkg:golang/github.com/argoproj/argo-cd","ranges":[">=1.8.2"],"fixed":[]},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2","ranges":["<2.3.14",">=2.4.0 <2.4.20",">=2.5.0 <2.5.8",">=2.6.0-rc1 <2.6.0-rc5"],"fixed":["2.3.14","2.4.20","2.5.8","2.6.0-rc5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}