Read the docs
TI-2023-10625 Aliases CVE-2023-25163GHSA-mv6w-j4xc-qpfw

Argo CD leaks repository credentials in user-facing error messages and in logs

Priority LOW 30CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have `applications, create` or `applications, update` RBAC access to reach the code which may produce the error. The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. If the user has `repositories, update` access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway. A patch for this vulnerability has been released in version 2.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00843 58th percentileScored 2026-11-07
Fix Fixed argo-cd (argoproj): 2.6.1github.com/argoproj/argo-cd/v2 (Go): 2.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-cd2.6.0-rc1 to before 2.6.12.6.1Patch availableCNA
—github.com/argoproj/argo-cd/v2 (Go)2.6.0-rc1 to before 2.6.12.6.1Patch availableGHSA-mv6w-j4xc-qpfw
  • argo-cd Vendorargoproj Affected 2.6.0-rc1 to before 2.6.1 Fixed in 2.6.1 Patch available CNA
  • github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.6.0-rc1 to before 2.6.1 Fixed in 2.6.1 Patch available GHSA-mv6w-j4xc-qpfw

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_cd:2.6.0:-:*:*:*:*:*:*2.6.0Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc1:*:*:*:*:*:*2.6.0 rc1Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc2:*:*:*:*:*:*2.6.0 rc2Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc3:*:*:*:*:*:*2.6.0 rc3Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc4:*:*:*:*:*:*2.6.0 rc4Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc5:*:*:*:*:*:*2.6.0 rc5Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc6:*:*:*:*:*:*2.6.0 rc6Vulnerableargoproj
cpe:2.3:a:argoproj:argo_cd:2.6.0:rc7:*:*:*:*:*:*2.6.0 rc7Vulnerableargoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:-:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc1:*:*:*:*:*:* Versions 2.6.0 rc1 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc2:*:*:*:*:*:* Versions 2.6.0 rc2 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc3:*:*:*:*:*:* Versions 2.6.0 rc3 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc4:*:*:*:*:*:* Versions 2.6.0 rc4 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc5:*:*:*:*:*:* Versions 2.6.0 rc5 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc6:*:*:*:*:*:* Versions 2.6.0 rc6 Vulnerable ·argoproj
  • cpe:2.3:a:argoproj:argo_cd:2.6.0:rc7:*:*:*:*:*:* Versions 2.6.0 rc7 Vulnerable ·argoproj

Remediation

  • Fix · CNA argo-cd (argoproj) Fixed in 2.6.1
  • Fix · GHSA-mv6w-j4xc-qpfw github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.6.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25163
  2. 2026-10-03 Alias added: GHSA-mv6w-j4xc-qpfw

References

Patch 1

Advisory 3

Other 4

  • TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
  • TI-2024-14383 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVSS 3.1CRITICAL 9.1
  • TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
  • TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
  • TI-2024-21088 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVSS 3.1CRITICAL 9.1
  • TI-2026-33475 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CVSS 3.1HIGH 8.7
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences