-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from in-memory storage of login attempts (LoginAttempts struct) and unsafe cache management in updateFailureCount(). The function's logic to delete random entries when the cache is full (without persistence) allows attackers to trigger crashes (via DoS) and reset counters. The commit diff shows this function was modified to add protections (pickRandomNonAdminLoginFailure), confirming its central role in the vulnerability chain. The lack of persistent storage in the original implementation directly enables the brute force bypass.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-cd/v2 | go | < 2.8.13 | 2.8.13 |
| github.com/argoproj/argo-cd/v2 | go | >= 2.9.0, < 2.9.9 | 2.9.9 |
| github.com/argoproj/argo-cd/v2 | go | >= 2.10.0, < 2.10.4 | 2.10.4 |