DEV Community

kozhevniko
kozhevniko

Posted on

Argo CD: 62,236 fingerprints, but only 497 still answer on its documented port 8080

#zoomeye #exposuremeasurement #kubernetes #gitops

Argo CD: 62,236 fingerprints, but only 497 still answer on its documented port 8080

Argo CD is a declarative GitOps controller for Kubernetes. It watches a Git repository and reconciles cluster state to match it, and it presents a web UI where a human can see drift and approve a sync. The UI is the part with an internet footprint, and the footprint is the largest of any product measured in this series.

Queries were run against ZoomEye on 26 October 2026 with sub_type=all, page 1 and pagesize=1.

Query Field Total
app="Argo CD" application fingerprint 62,236
title="Argo CD" HTML title 62,236
ssl="Argo CD" certificate content 30,239
app="Argo CD" && port=443 fingerprint plus HTTPS 25,079
port=8080 bare port count 55,159,209
app="Argo CD" && port=8080 fingerprint plus documented port 497

The fingerprint and the title agree exactly, which is unusual

62,236 on app and 62,236 on title is an identical number, and identical numbers are a signal. It means the fingerprint rule is effectively derived from the page title: every host that ZoomEye classifies as Argo CD also returns a page titled with the product name, and every host whose title contains the product name is classified as Argo CD.

That is a comfortable agreement for measurement purposes and a fragile one for identification. If a future release changes the page title, both figures move together and the fingerprint stops working. It also means the number describes "hosts returning an Argo CD page", which is a slightly narrower claim than "hosts running Argo CD" — a deployment whose UI is behind a login proxy that rewrites the title would not be counted.

The documented port is nearly empty

This is the finding worth carrying: 497 of 62,236. Less than one percent of fingerprinted hosts answer on 8080, which is the port the getting-started instructions use.

Zero point eight percent. A port-based scan for Argo CD on its documented port would miss 99.2% of the population.

Two mechanisms explain it, and both are ordinary practice:

  • Argo CD is normally published through an ingress on 443 with TLS, so the port the manifest uses inside the cluster is never the port the world sees. 25,079 hosts — 40.3% — answer on 443, which is consistent with this.
  • Some deployments use the argocd-server in insecure or TLS-terminated mode behind a load balancer, again landing on 443.

The gap between 25,079 on 443 and 62,236 overall is the part not described by either port. Those hosts answer on something else entirely, or their port information is not represented in the index fields queried here.

The bare port count shows why port scans fail

55,159,209 hosts answer on 8080. That is a population 886 times larger than the Argo CD fingerprint, and it is dominated by application servers, development instances, proxies and appliances. A scan that finds an open 8080 has learned almost nothing about what is behind it.

The conjunction is what carries the information. 62,236 is a product population; 497 is a product population on a specific port; 55 million is a port.

Why 62,236 matters more than the port distribution

Argo CD is not a passive dashboard. It holds credentials for every cluster it manages, and the UI exposes those clusters by name.

  • The application list shows repository URLs, target clusters and namespaces. That is a map of the delivery pipeline.
  • The repository credentials, cluster bearer tokens and SSO client secrets sit in Kubernetes Secrets in the Argo CD namespace, which the server reads.
  • The default installation generates an admin password from the server pod name, and the documentation instructs operators to retrieve it and change it. A deployment that skipped that step has a guessable or default credential.
  • If SSO is not configured, the local admin account is the only gate, and its permissions are unrestricted.

An exposed Argo CD with local admin and an unchanged password is a cluster takeover, not an information disclosure. That is why a population of 62,236 internet-facing instances is a more consequential number than the same count for a monitoring product.

Checking your own deployment

  • Confirm the server is behind an ingress with TLS and that port 8080 is not directly reachable.
  • Confirm the generated admin password was replaced, or that local login is disabled after SSO is configured.
  • Review which clusters and repositories the UI lists, because a reachable UI reveals the estate even when it refuses a login.
  • Scope the server's RBAC so that an authenticated account does not automatically hold cluster-admin.

The queries are reproducible at zoomeye.org. The takeaway is the mismatch between documentation and deployment: the port in the getting-started guide describes 0.8% of what is actually on the internet, and any inventory built from that port is wrong by two orders of magnitude.

References

Top comments (0)