CVE-2022-29165

CVE-2022-29165 is a critical vulnerability in Argo CD versions 1.4.0 through 2.1.14, 2.2.8, and 2.3.3, allowing unauthenticated users to impersonate any Argo CD user or role, including the admin, by sending a crafted JSON Web Token (JWT). This vulnerability has a CVSS score of 10.0 (CRITICAL) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Exploitation requires anonymous access to be enabled, which is not the default configuration. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.