Skip to content
Argoproj vulnerabilities
Newest
-
argoproj argo-cd
Argo CD: A Kustomize Helm config home can run commands in the repo-server
CVE-2026-113709
Fix available
9.9 Critical
-
argoproj argo-cd
Argo CD: A Kustomize remote ref can run commands in the repo-server
CVE-2026-113708
Fix available
9.9 Critical
-
argoproj argo-cd
Argo CD: A Jsonnet import can read files from the repo-server
CVE-2026-113672
Fix available
9.9 Critical
-
argoproj argo-cd
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
CVE-2026-77459
Fix available
9.9 Critical
-
argoproj argo-cd
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
CVE-2026-55797
Fix available
8.8 High
-
argoproj argo-workflows
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
CVE-2026-93991
Fix available
8.3 High
-
argoproj argo-rollouts
Argo Rollouts Dashboard Unauthenticated Mutating Operations
CVE-2026-82277
9.3 Critical
-
argoproj argo workflows, argo-workflows +1 more
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
CVE-2026-54526
Fix available
8.9 High
-
red hat openshift gitops, argoproj argo-helm, red hat openshift data foundation 4 +1 more +3 more
Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
CVE-2026-15416
8.9 High
-
argoproj argo-helm
Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE
CVE-2026-62185
8.6 High
-
argoproj argo cd, argo-cd +1 more
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
CVE-2026-45738
Fix available
7.3 High
-
argoproj argo cd, argo-cd +1 more
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
CVE-2026-45737
Fix available
6.3 Medium
-
argoproj argo workflows, argo-workflows +1 more
Argo Workflows: Exposure of artifact repository credentials
CVE-2026-42295
Fix available
8.5 High
-
argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
CVE-2026-42296
Fix available
8.1 High
-
argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
CVE-2026-42294
Fix available
8.2 High
-
argoproj argo workflows, argo-workflows +1 more
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
CVE-2026-42183
Fix available
2.3 Low
-
argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
CVE-2026-42297
Fix available
8.5 High
-
argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 more
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
CVE-2026-42880
Public exploitFix available
9.6 Critical
-
argoproj argo cd, red hat openshift data foundation 4, openshift gitops +2 more
In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext...
CVE-2026-43824
7.7 High
-
argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
CVE-2026-40886
Fix available
7.7 High
-
argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 more
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
CVE-2026-31892
Fix available
8.9 High
-
argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 more
Argo Workflows has unauthorized access to Argo Workflows Template
CVE-2026-28229
Fix available
9.8 Critical
-
argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more
Argo Workflows affected by stored XSS in the artifact directory listing
CVE-2026-23960
Fix available
7.3 High
-
argoproj argo-workflows, argo workflows +1 more
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
CVE-2025-66626
Fix available
8.1 High
-
argoproj argo workflows, argo-workflows +1 more
Argo Workflows exposes artifact repository credentials in workflow-controller logs
CVE-2025-62157
Fix available
8.5 High
-
argoproj argo-workflows, argo workflows +1 more
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
CVE-2025-62156
Fix available
8.1 High
-
argoproj argo cd, argo-cd +1 more
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
CVE-2025-59538
Fix available
7.5 High
-
argoproj argo-cd, argo cd +1 more
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
CVE-2025-59537
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
CVE-2025-59531
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Repository Credentials Race Condition Crashes Argo CD Server
CVE-2025-55191
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD: Project API Token Exposes Repository Credentials
CVE-2025-55190
Fix available
10.0 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD allows cross-site scripting on repositories page
CVE-2025-47933
Fix available
9.1 Critical
-
argoproj argo-events
Users can gain privileged access to the host system and cluster with EventSource and Sensor CR
CVE-2025-32445
Fix available
10.0 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD does not scrub secret values from patch errors
CVE-2025-23216
Fix available
6.8 Medium
-
argoproj argo workflows, argo-workflows +1 more
Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode
CVE-2024-53862
Fix available
6.3 Medium
-
argoproj argo-helm
Helm Lacks Granularity in Workflow Role
CVE-2024-52814
2.8 Low
-
argoproj argo-helm
Argo Workflows Chart: Excessive Privileges in Workflow Role
CVE-2024-52799
8.3 High
-
argoproj argo workflows, argo-workflows +1 more
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
CVE-2024-47827
Fix available
5.7 Medium
-
argoproj argo cd, argo-cd +1 more
The Argo CD web terminal session does not handle the revocation of user permissions properly.
CVE-2024-41666
Fix available
4.7 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
CVE-2024-40634
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Unauthenticated Access to sensitive settings in Argo CD
CVE-2024-37152
Fix available
5.3 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD allows authenticated users to enumerate clusters by name
CVE-2024-36106
Fix available
4.3 Medium
-
argoproj argo cd, argo-cd +1 more
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
CVE-2024-31989
Public exploitFix available
9.1 Critical
-
argoproj argo cd, argo-cd +1 more
Denial of Service via malicious jqPathExpressions in ignoreDifferences
CVE-2024-32476
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD' API server does not enforce project sourceNamespaces
CVE-2024-31990
Fix available
4.8 Medium
-
argoproj argo cd, argo-cd +1 more
Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
CVE-2024-29893
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
CVE-2024-21661
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow
CVE-2024-21662
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
CVE-2024-21652
Fix available
9.8 Critical
-
argoproj argo-cd, argo cd +1 more
Users with `create` but not `override` privileges can perform local sync in argo-cd
CVE-2023-50726
Fix available
6.4 Medium
- Show olderLoading…