{"id":"GHSA-274v-mgcv-cm8j","aliases":["GO-2025-3437"],"status":"published","title":"Argo CD GitOps Engine does not scrub secret values from patch errors","description":"### Impact\nA vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. \n\nThe vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.\n\n### Patches\nA patch for this vulnerability is available in the following Argo CD versions:\n- v2.13.4\n- v2.12.10\n- v2.11.13\n\n### Workarounds\nThere is no workaround other than upgrading.\n\n### Resources\nFixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 \u0026 https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-01-30T17:51:33Z","modified":"2026-09-10T03:50:56Z","fixes":[{"ecosystem":"Go","package":"github.com/argoproj/gitops-engine","fixed_in":["0.7.1-0.20250129155113-4c6e03c463141"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/gitops-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.2"},{"last_affected":"0.7.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/gitops-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-0.20250129155113-4c6e03c463141"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/gitops-engine","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.2"},{"last_affected":"0.7.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/gitops-engine","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.1-0.20250129155113-4c6e03c463141"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/gitops-engine","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.2"}]}]}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v","tags":["web"]},{"url":"https://github.com/argoproj/gitops-engine/security/advisories/GHSA-274v-mgcv-cm8j","tags":["web","advisory"]},{"url":"https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107","tags":["web"]},{"url":"https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3437","tags":["web"]},{"url":"https://github.com/advisories/GHSA-274v-mgcv-cm8j"},{"url":"https://github.com/argoproj/gitops-engine","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-274v-mgcv-cm8j","title":"Argo CD GitOps Engine does not scrub secret values from patch errors","description":"### Impact\nA vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. \n\nThe vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.\n\n### Patches\nA patch for this vulnerability is available in the following Argo CD versions:\n- v2.13.4\n- v2.12.10\n- v2.11.13\n\n### Workarounds\nThere is no workaround other than upgrading.\n\n### Resources\nFixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 \u0026 https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca","status":"published","published":"2025-01-30T17:51:33Z","modified":"2025-12-20T03:10:37Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:39:14.093341Z"}],"osv":[{"id":"GHSA-274v-mgcv-cm8j","title":"Argo CD GitOps Engine does not scrub secret values from patch errors","description":"### Impact\nA vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. \n\nThe vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.\n\n### Patches\nA patch for this vulnerability is available in the following Argo CD versions:\n- v2.13.4\n- v2.12.10\n- v2.11.13\n\n### Workarounds\nThere is no workaround other than upgrading.\n\n### Resources\nFixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 \u0026 https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca","status":"published","published":"2025-01-30T17:51:33Z","modified":"2026-09-10T03:50:56.312982686Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GO-2025-3437","title":"Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine","description":"Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/argoproj/gitops-engine before v0.7.1-0.20250129155113-4c6e03c463141.","status":"published","published":"2025-02-04T22:06:11Z","modified":"2026-02-04T03:47:49.377346Z","updated_at":"2026-11-02T15:47:01.728182Z"}]}}