CVE-2022-31105

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the `oidc.config.rootCA` field in the `argocd-cm` ConfigMap. This mitigation only forces certificate validation when the API server handles login flows. It does not force certificate verification when verifying tokens on API calls.

• CWE-295
• CWE-599
• CWE-295

• https://github.com/argoproj/argo-cd/releases/tag/v2.3.6Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.4.5Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.3.6Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/releases/tag/v2.4.5Release Notes, Third Party Advisory
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5Third Party Advisory

Published

Jul 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3110An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31100rulex is a new, portable, regular expression language. When …6.5
• CVE-2022-31101prestashop/blockwishlist is a prestashop extension which add…8.8
• CVE-2022-31102Argo CD is a declarative, GitOps continuous delivery tool fo…6.1
• CVE-2022-31103lettersanitizer is a DOM-based HTML email sanitizer for in-b…7.5
• CVE-2022-31104Wasmtime is a standalone runtime for WebAssembly. In affecte…5.6
• CVE-2022-31106Underscore.deep is a collection of Underscore mixins that op…9.8
• CVE-2022-31107Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2022-31108Mermaid is a JavaScript based diagramming and charting tool …6.1
• CVE-2022-31109laminas-diactoros is a PHP package containing implementation…6.1
• CVE-2022-3111An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31110RSSHub is an open source, extensible RSS feed generator. In …7.5