Vulnerabilities

TI-2026-33474 CVE-2026-45737 · GHSA-rg3g-4rw9-gqrp

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

MEDIUM 62

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00521 Published 2026-07-15 Fixed in 3.2.12, 3.3.10 +1 CWE-200

TI-2026-33475 CVE-2026-45738 · GHSA-h98r-wv3h-fr38

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

HIGH 73

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00606 Published 2026-07-15 Fixed in 3.2.12, 3.3.10 +1 CWE-79

TI-2026-31086 CVE-2026-42880 · GHSA-3v3m-wc6v-x4x3

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

HIGH 76

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00645 Published 2026-05-07 Partial fix · 3.2.11, 3.3.9 CWE-200

TI-2025-37068 CVE-2025-59538 · GHSA-gpx4-37g2-c8pv

Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10113 Published 2025-10-01 Partial fix · 2.14.20, 3.2.0-rc2 +2 CWE-248

TI-2025-37067 CVE-2025-59537 · GHSA-wp4p-9pxh-cgx2

argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00604 Published 2025-10-01 Partial fix · 2.14.20, 3.2.0-rc2 +2 CWE-20

TI-2025-37062 CVE-2025-59531 · GHSA-f9gq-prrc-hrhc

Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00588 Published 2025-10-01 Fixed in 2.14.20, 3.2.0-rc2 +2 CWE-703

TI-2025-34867 CVE-2025-55191 · GHSA-g88p-r42r-ppp9

Repository Credentials Race Condition Crashes Argo CD Server

LOW 29

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00483 Published 2025-09-30 Partial fix · 2.14.20, 3.1.8 +2 CWE-362

TI-2025-34866 CVE-2025-55190 · GHSA-786q-9hcg-v9ff

Argo CD: Project API Token Exposes Repository Credentials

MEDIUM 51

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05655 Published 2025-09-04 Partial fix · 2.13.9, 2.14.16 +2 CWE-200

TI-2025-30326 CVE-2025-47933 · GHSA-2hj5-g64g-fp6p

Argo CD allows cross-site scripting on repositories page

MEDIUM 42

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00486 Published 2025-05-29 Partial fix · 2.13.8, 2.14.13 +1 CWE-79

TI-2025-17001 CVE-2025-23216 · GHSA-47g2-qmh2-749v

Argo CD does not scrub secret values from patch errors

LOW 30

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00465 Published 2025-01-30 Fixed in 2.13.4, 2.12.10 +1 CWE-200

TI-2024-27728 CVE-2024-41666 · GHSA-v8wx-v5jq-qhhw

The Argo CD web terminal session does not handle the revocation of user permissions properly.

MEDIUM 62

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00685 Published 2024-07-24 Partial fix · 2.9.21, 2.10.16 +1 CWE-269

TI-2024-27046 CVE-2024-40634 · GHSA-jmvp-698c-4x3w

Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01392 Published 2024-07-22 Fixed in 2.9.20, 2.10.15 +1 CWE-400

TI-2024-24679 CVE-2024-37152 · GHSA-87p9-x75h-p4j2

Unauthenticated Access to sensitive settings in Argo CD

MEDIUM 43

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02348 Published 2024-06-06 Partial fix · 2.9.17, 2.10.12 +1 CWE-287

TI-2024-23936 CVE-2024-36106 · GHSA-3cqf-953p-h5cp

Argo CD allows authenticated users to enumerate clusters by name

LOW 20

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00408 Published 2024-06-06 Partial fix · 2.10.12, 2.11.3 +1 CWE-209

TI-2024-21088 CVE-2024-31989 · GHSA-9766-5277-j5hr

ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

HIGH 74

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Adjacent network Low privileges No interaction EPSS 0.01479 Published 2024-05-21 Fixed in 2.8.19, 2.9.15 +2 CWE-327

TI-2024-21370 CVE-2024-32476 · GHSA-9m6p-x4h2-6frq

Denial of Service via malicious jqPathExpressions in ignoreDifferences

LOW 31

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01005 Published 2024-04-26 Fixed in 2.10.8, 2.9.13 +1 CWE-400

TI-2024-21089 CVE-2024-31990 · GHSA-2gvw-w6fj-7m3c

Argo CD' API server does not enforce project sourceNamespaces

LOW 28

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00445 Published 2024-04-15 Partial fix · 2.10.7, 2.9.12 +1 CWE-863

TI-2024-19661 CVE-2024-29893 · GHSA-jhwx-mhww-rgc3

Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

LOW 31

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00972 Published 2024-03-29 Fixed in 2.8.14, 2.9.10 +1 CWE-400

TI-2024-14383 CVE-2024-21662 · GHSA-2vgg-9h6w-m454

Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

HIGH 78

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-307

TI-2024-14382 CVE-2024-21661 · GHSA-6v85-wr92-q4p7

Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01176 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-787

TI-2024-14377 CVE-2024-21652 · GHSA-x32m-mvfj-52xv

Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

HIGH 82

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00751 Published 2024-03-18 Partial fix · 2.8.13, 2.9.9 +1 CWE-307

TI-2023-27672 CVE-2023-50726 · GHSA-g623-jcgg-mhmm

Users with `create` but not `override` privileges can perform local sync in argo-cd

LOW 29

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00532 Published 2024-03-13 Fixed in 2.8.12, 2.9.8 +1 CWE-269

TI-2024-18753 CVE-2024-28175 · GHSA-jwv5-8mqv-g387

Cross-site scripting on application summary component in argo-cd

MEDIUM 42

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00654 Published 2024-03-13 Fixed in 2.8.12, 2.9.8 +1 CWE-79

TI-2024-14997 CVE-2024-22424 · GHSA-92mw-q256-5vwg

Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

HIGH 72

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00484 Published 2024-01-19 Fixed in 2.7.15, 2.8.8 +3 CWE-352

TI-2023-20916 CVE-2023-40026 · GHSA-6jqw-jwf5-rp8h

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

LOW 24

Argo CD is a declarative continuous deployment framework for Kubernetes.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00612 Published 2023-09-27 Fixed in 2.3, 2.3.0 CWE-22

Vulnerabilities

Filters