argoproj

Records88All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical21CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

argoproj records in CISA KEV

No argoproj vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Argo Cd 57 records HIGH Argo Workflows 17 records HIGH

Records

88 records

TI-2026-22564 CVE-2026-28229 · GHSA-56px-hm34-xqj5

Argo Workflows has unauthorized access to Argo Workflows Template

HIGH 82

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00725 Published 2026-03-11 Fixed in 4.0.2, 3.7.11 CWE-863

TI-2024-14377 CVE-2024-21652 · GHSA-x32m-mvfj-52xv

Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

HIGH 82

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00751 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-307

TI-2024-14383 CVE-2024-21662 · GHSA-2vgg-9h6w-m454

Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

HIGH 78

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-307

TI-2026-31086 CVE-2026-42880 · GHSA-3v3m-wc6v-x4x3

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

HIGH 76

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00645 Published 2026-05-07 Partial fix · 3.2.11, 3.3.9 CWE-200

TI-2023-20919 CVE-2023-40029 · GHSA-fwr2-64vr-xv9m

Cluster secret might leak in cluster details page in Argo CD

HIGH 76

Argo CD is a declarative continuous deployment for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01196 Published 2023-09-07 Fixed in 2.6.15, 2.7.14 +1 CWE-200

TI-2026-30603 CVE-2026-42294 · GHSA-jcc8-g2q4-9fxq

Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

HIGH 75

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00599 Published 2026-05-09 Fixed in 3.7.14, 4.0.5 CWE-770

TI-2026-39371 CVE-2026-54526 · GHSA-48p8-g2fx-3wwm

Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

HIGH 74

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.9 Network Low privileges No interaction EPSS 0.00553 Published 2026-07-16 Fixed in 3.7.15, 4.0.6 CWE-284

TI-2026-24444 CVE-2026-31892 · GHSA-3wf5-g532-rcrr

WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

HIGH 74

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.9 Network Low privileges No interaction EPSS 0.00554 Published 2026-03-11 Fixed in 4.0.2, 3.7.11 CWE-863

TI-2024-21088 CVE-2024-31989 · GHSA-9766-5277-j5hr

ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

HIGH 74

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Adjacent network Low privileges No interaction EPSS 0.01479 Published 2024-05-21 Fixed in 2.8.19, 2.9.15 +2 CWE-327

TI-2026-33475 CVE-2026-45738 · GHSA-h98r-wv3h-fr38

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

HIGH 73

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00606 Published 2026-07-15 Fixed in 3.2.12, 3.3.10 +1 CWE-79

TI-2026-30604 CVE-2026-42295 · GHSA-7vf8-2cr6-54mf

Argo Workflows: Exposure of artifact repository credentials

HIGH 72

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00357 Published 2026-05-09 Partial fix · 4.0.5 CWE-522

TI-2025-37068 CVE-2025-59538 · GHSA-gpx4-37g2-c8pv

Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09364 Published 2025-10-01 Partial fix · 2.14.20, 3.2.0-rc2 +2 CWE-248

TI-2025-37067 CVE-2025-59537 · GHSA-wp4p-9pxh-cgx2

argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00604 Published 2025-10-01 Partial fix · 2.14.20, 3.2.0-rc2 +2 CWE-20

TI-2025-37062 CVE-2025-59531 · GHSA-f9gq-prrc-hrhc

Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00588 Published 2025-10-01 Fixed in 2.14.20, 3.2.0-rc2 +2 CWE-703

TI-2024-27046 CVE-2024-40634 · GHSA-jmvp-698c-4x3w

Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01392 Published 2024-07-22 Fixed in 2.9.20, 2.10.15 +1 CWE-400

TI-2024-14997 CVE-2024-22424 · GHSA-92mw-q256-5vwg

Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00484 Published 2024-01-19 Fixed in 2.7.15, 2.8.8 +3 CWE-352

TI-2024-14382 CVE-2024-21661 · GHSA-6v85-wr92-q4p7

Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01176 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-787

TI-2025-38478 CVE-2025-62156 · GHSA-p84v-gxvw-73pf

argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite

HIGH 71

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00605 Published 2025-10-14 Partial fix · 3.6.12, 3.7.3 CWE-22

TI-2024-35312 CVE-2024-52799

Argo Workflows Chart: Excessive Privileges in Workflow Role

HIGH 71

Argo Workflows Chart is used to set up argo and its needed dependencies through one command.

CVSS 3.1HIGH 8.3 Local Low privileges User interaction EPSS 0.00211 Published 2024-11-21 Fixed in 0.44.0 CWE-1220

TI-2026-30606 CVE-2026-42297 · GHSA-xchc-cqwg-g76q

Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00515 Published 2026-05-09 Fixed in 4.0.5 CWE-862

TI-2026-30605 CVE-2026-42296 · GHSA-3775-99mw-8rp4

Incorrect authorization in argoproj argo-workflows

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-05-09 Fixed in 3.7.14, 4.0.5 CWE-863

TI-2025-41020 CVE-2025-66626 · GHSA-xrqc-7xgx-c9vh

argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

HIGH 70

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0068 Published 2025-12-09 Fixed in 3.7.5, 3.6.14 CWE-23

TI-2026-31913 CVE-2026-43824 · GHSA-c7mp-5hg2-gfh8

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

HIGH 67

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00268 Published 2026-05-02 Partial fix · 3.2.11, 3.3.9 CWE-212

TI-2026-29542 CVE-2026-40886 · GHSA-5jv8-h7qh-rf5p

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

HIGH 67

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00377 Published 2026-04-23 Fixed in 4.0.5, 3.7.14 CWE-129

TI-2024-36055 CVE-2024-53862 · GHSA-h36c-m3rf-34h9

Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode

HIGH 67

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0066 Published 2024-12-02 Fixed in 3.5.13, 3.6.2 CWE-200

Open these records in search →