-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-cd | go | >= 2.6.0, < 2.6.14 | 2.6.14 |
| github.com/argoproj/argo-cd | go | >= 2.7.0, < 2.7.12 | 2.7.12 |
| github.com/argoproj/argo-cd | go | = 2.8.0 | 2.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing token validation in websocket message handling. The patch added: 1) SessionManager integration in terminalSession struct 2) Token verification in Read() method 3) Reconnect logic when tokens expire. The original Read() method (vulnerable) lacked the critical 'VerifyToken' check shown in the diff, allowing sessions to persist after token expiration. The newTerminalSession function's pre-patch version didn't pass sessionManager, preventing token validation infrastructure from being available during session initialization.