Medium severity · published Jun 27, 2022
CVE-2022-31035
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
5.4
CVSS
1%
EPSS
No
On KEV
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). The script would be capable of doing anything which is possible in the UI or via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no completely-safe workarounds besides upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Argo CD · Argoproj
1.0.0 before 2.1.16; 2.2.9; 2.3.4; 2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31035
Vendor Advisory
https://argo-cd.readthedocs.io/en/stable/user-guide/external-url/
Patch
https://github.com/argoproj/argo-cd/commit/8bc3ef690de29c68a36f473908774346a44d4038
Mitigation
https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj
More from Argo CD
10.0
CVE-2022-29165
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
CVE-2026-113709
Argo CD: A Kustomize Helm config home can run commands in the repo-server
9.9
CVE-2026-113708
Argo CD: A Kustomize remote ref can run commands in the repo-server
9.9
CVE-2026-113672
Argo CD: A Jsonnet import can read files from the repo-server
9.9
CVE-2026-77459
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks