argoproj

Records88All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical21CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

argoproj records in CISA KEV

No argoproj vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Argo Cd 57 records HIGH Argo Workflows 17 records HIGH

Records

57 records in Argo Cd · all components

TI-2024-14377 CVE-2024-21652 · GHSA-x32m-mvfj-52xv

Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

HIGH 82

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00751 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-307

TI-2024-14383 CVE-2024-21662 · GHSA-2vgg-9h6w-m454

Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

HIGH 78

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-307

TI-2026-31086 CVE-2026-42880 · GHSA-3v3m-wc6v-x4x3

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

HIGH 76

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00645 Published 2026-05-07 Partial fix · 3.2.11, 3.3.9 CWE-200

TI-2023-20919 CVE-2023-40029 · GHSA-fwr2-64vr-xv9m

Cluster secret might leak in cluster details page in Argo CD

HIGH 76

Argo CD is a declarative continuous deployment for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01196 Published 2023-09-07 Fixed in 2.6.15, 2.7.14 +1 CWE-200

TI-2024-21088 CVE-2024-31989 · GHSA-9766-5277-j5hr

ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

HIGH 74

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Adjacent network Low privileges No interaction EPSS 0.01479 Published 2024-05-21 Fixed in 2.8.19, 2.9.15 +2 CWE-327

TI-2026-33475 CVE-2026-45738 · GHSA-h98r-wv3h-fr38

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

HIGH 73

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00606 Published 2026-07-15 Fixed in 3.2.12, 3.3.10 +1 CWE-79

TI-2025-37068 CVE-2025-59538 · GHSA-gpx4-37g2-c8pv

Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09364 Published 2025-10-01 Partial fix · 2.14.20, 3.2.0-rc2 +2 CWE-248

TI-2025-37067 CVE-2025-59537 · GHSA-wp4p-9pxh-cgx2

argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00604 Published 2025-10-01 Partial fix · 2.14.20, 3.2.0-rc2 +2 CWE-20

TI-2025-37062 CVE-2025-59531 · GHSA-f9gq-prrc-hrhc

Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00588 Published 2025-10-01 Fixed in 2.14.20, 3.2.0-rc2 +2 CWE-703

TI-2024-27046 CVE-2024-40634 · GHSA-jmvp-698c-4x3w

Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01392 Published 2024-07-22 Fixed in 2.9.20, 2.10.15 +1 CWE-400

TI-2024-14997 CVE-2024-22424 · GHSA-92mw-q256-5vwg

Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00484 Published 2024-01-19 Fixed in 2.7.15, 2.8.8 +3 CWE-352

TI-2024-14382 CVE-2024-21661 · GHSA-6v85-wr92-q4p7

Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01176 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-787

TI-2026-33474 CVE-2026-45737 · GHSA-rg3g-4rw9-gqrp

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

MEDIUM 62

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00521 Published 2026-07-15 Fixed in 3.2.12, 3.3.10 +1 CWE-200

TI-2024-27728 CVE-2024-41666 · GHSA-v8wx-v5jq-qhhw

The Argo CD web terminal session does not handle the revocation of user permissions properly.

MEDIUM 62

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00685 Published 2024-07-24 Partial fix · 2.9.21, 2.10.16 +1 CWE-269

TI-2022-11709 CVE-2022-29165 · GHSA-r642-gv9p-2wjj

Argo CD will blindly trust JWT claims if anonymous access is enabled

MEDIUM 53

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02103 Published 2022-05-20 Fixed in 2.1.15, 2.2.9 +1 CWE-200

TI-2025-34866 CVE-2025-55190 · GHSA-786q-9hcg-v9ff

Argo CD: Project API Token Exposes Repository Credentials

MEDIUM 51

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05655 Published 2025-09-04 Partial fix · 2.13.9, 2.14.16 +2 CWE-200

TI-2022-08582 CVE-2022-24768 · GHSA-2f5v-8r3f-8pww

Improper access control allows admin privilege escalation in Argo CD

MEDIUM 45

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0125 Published 2022-03-23 Fixed in 2.1.14, 2.2.8 +1 CWE-200

TI-2022-13149 CVE-2022-31105 · GHSA-7943-82jg-wmw5

Argo CD's certificate verification is skipped for connections to OIDC providers

MEDIUM 44

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00808 Published 2022-07-12 Fixed in 2.2.11, 2.3.6 +1 CWE-295

TI-2024-24679 CVE-2024-37152 · GHSA-87p9-x75h-p4j2

Unauthenticated Access to sensitive settings in Argo CD

MEDIUM 43

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02348 Published 2024-06-06 Partial fix · 2.9.17, 2.10.12 +1 CWE-287

TI-2023-08731 CVE-2023-22482 · GHSA-q9hr-j4rf-8fjc

JWT audience claim is not verified

MEDIUM 43

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00903 Published 2023-01-25 Fixed in 2.3.13, 2.4.19 +6 CWE-863

TI-2022-13080 CVE-2022-31035 · GHSA-h4w9-6x78-8vrj

External URLs for Deployments can include javascript in argo-cd

MEDIUM 43

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00986 Published 2022-06-27 Fixed in 2.1.16, 2.2.10 +2 CWE-79

TI-2025-30326 CVE-2025-47933 · GHSA-2hj5-g64g-fp6p

Argo CD allows cross-site scripting on repositories page

MEDIUM 42

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00486 Published 2025-05-29 Partial fix · 2.13.8, 2.14.13 +1 CWE-79

TI-2024-18753 CVE-2024-28175 · GHSA-jwv5-8mqv-g387

Cross-site scripting on application summary component in argo-cd

MEDIUM 42

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00654 Published 2024-03-13 Fixed in 2.8.12, 2.9.8 +1 CWE-79

TI-2023-09744 CVE-2023-23947 · GHSA-3jfq-742w-xg8j

Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets

MEDIUM 42

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00671 Published 2023-02-16 Fixed in 2.3.17, 2.4.23 +2 CWE-863

TI-2020-07085 CVE-2020-8828 · GHSA-h8jc-jmrf-9h8f

As of v1.5.0, the default admin password is set to the argocd-server pod name.

MEDIUM 42

As of v1.5.0, the default admin password is set to the argocd-server pod name.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.018 Published 2020-04-08 No fix listed CWE-1188

Open these records in search →