# Argo CD v2.1.15 — Release & Upgrade Intelligence
- **Product:** Argo CD (https://argo-cd.readthedocs.io)
- **Version:** v2.1.15
- **Released:** May 18, 2022
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/argocd/updates/v2.1.15/

## Executive Summary (TL;DR)
Argo CD v2.1.15. Source highlight: kubectl create namespace argocd

## Bug Fixes
- CRITICAL: Argo CD will trust invalid JWT claims if anonymous access is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-r642-gv9p-2wjj)
- LOW: Login screen allows message spoofing if SSO is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j)
- MODERATE: Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server (https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h)