Argoproj Argo-cd vulnerabilities

• argoproj argo-cd Argo CD: A Kustomize Helm config home can run commands in the repo-server CVE-2026-113709 Fix available 9.9 CriticalOctober 20, 2026
• argoproj argo-cd Argo CD: A Kustomize remote ref can run commands in the repo-server CVE-2026-113708 Fix available 9.9 CriticalOctober 20, 2026
• argoproj argo-cd Argo CD: A Jsonnet import can read files from the repo-server CVE-2026-113672 Fix available 9.9 CriticalOctober 20, 2026
• argoproj argo-cd Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks CVE-2026-77459 Fix available 9.9 CriticalOctober 13, 2026
• argoproj argo-cd Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL CVE-2026-55797 Public exploitFix available 8.8 HighOctober 9, 2026
• argoproj argo cd, argo-cd +1 more Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CVE-2026-45738 Fix available 7.3 HighMay 19, 2026
• argoproj argo cd, argo-cd +1 more Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations CVE-2026-45737 Fix available 6.3 MediumMay 19, 2026
• argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 more ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVE-2026-42880 Public exploitFix available 9.6 CriticalMay 2, 2026
• argoproj argo cd, argo-cd +1 more Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook CVE-2025-59538 Fix available EPSS 10.6% 7.5 HighSeptember 30, 2025
• argoproj argo-cd, argo cd +1 more argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload CVE-2025-59537 Fix available 7.5 HighSeptember 30, 2025
• argoproj argo cd, argo-cd +1 more Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload CVE-2025-59531 Fix available 7.5 HighSeptember 30, 2025
• argoproj argo cd, argo-cd +1 more Repository Credentials Race Condition Crashes Argo CD Server CVE-2025-55191 Fix available 6.5 MediumSeptember 30, 2025
• argoproj argo cd, argo-cd +1 more Argo CD: Project API Token Exposes Repository Credentials CVE-2025-55190 Fix available 10.0 CriticalSeptember 4, 2025
• argoproj argo cd, argo-cd +1 more Argo CD allows cross-site scripting on repositories page CVE-2025-47933 Fix available 9.1 CriticalMay 28, 2025
• argoproj argo cd, argo-cd +1 more Argo CD does not scrub secret values from patch errors CVE-2025-23216 Fix available 6.8 MediumJanuary 30, 2025
• argoproj argo cd, argo-cd +1 more The Argo CD web terminal session does not handle the revocation of user permissions properly. CVE-2024-41666 Fix available 4.7 MediumJuly 24, 2024
• argoproj argo cd, argo-cd +1 more Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint CVE-2024-40634 Fix available 7.5 HighJuly 22, 2024
• argoproj argo cd, argo-cd +1 more Unauthenticated Access to sensitive settings in Argo CD CVE-2024-37152 Fix available 5.3 MediumJune 6, 2024
• argoproj argo cd, argo-cd +1 more Argo CD allows authenticated users to enumerate clusters by name CVE-2024-36106 Fix available 4.3 MediumJune 6, 2024
• argoproj argo cd, argo-cd +1 more ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVE-2024-31989 Public exploitFix available 9.1 CriticalMay 21, 2024
• argoproj argo cd, argo-cd +1 more Denial of Service via malicious jqPathExpressions in ignoreDifferences CVE-2024-32476 Fix available 6.5 MediumApril 26, 2024
• argoproj argo cd, argo-cd +1 more Argo CD' API server does not enforce project sourceNamespaces CVE-2024-31990 Fix available 4.8 MediumApril 15, 2024
• argoproj argo cd, argo-cd +1 more Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server CVE-2024-29893 Fix available 6.5 MediumMarch 29, 2024
• argoproj argo cd, argo-cd +1 more Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment CVE-2024-21661 Fix available 7.5 HighMarch 18, 2024
• argoproj argo cd, argo-cd +1 more Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVE-2024-21662 Fix available 7.5 HighMarch 18, 2024
• argoproj argo cd, argo-cd +1 more Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVE-2024-21652 Fix available 9.8 CriticalMarch 18, 2024
• argoproj argo-cd, argo cd +1 more Users with `create` but not `override` privileges can perform local sync in argo-cd CVE-2023-50726 Fix available 6.4 MediumMarch 13, 2024
• argoproj argo-cd, argo cd +1 more Cross-site scripting on application summary component in argo-cd CVE-2024-28175 Fix available 9.1 CriticalMarch 13, 2024
• argoproj argo-cd, argo cd +1 more Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd CVE-2024-22424 Fix available 8.4 HighJanuary 19, 2024
• argoproj argo cd, argo-cd +1 more Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server CVE-2023-40026 Fix available 5.0 MediumSeptember 27, 2023
• argoproj argo cd, argo-cd +1 more Denial of Service to Argo CD repo-server CVE-2023-40584 Fix available 6.5 MediumSeptember 7, 2023
• argoproj argo cd, argo-cd +1 more Cluster secret might leak in cluster details page in Argo CD CVE-2023-40029 Public exploitFix available 9.9 CriticalSeptember 7, 2023
• argoproj argo cd, argo-cd +1 more Argo CD web terminal session doesn't expire CVE-2023-40025 Fix available 4.7 MediumAugust 23, 2023
• argoproj argo cd, argo-cd +1 more Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets CVE-2023-23947 Fix available 9.1 CriticalFebruary 16, 2023
• argoproj argo cd, argo-cd +1 more Argo CD leaks repository credentials in user-facing error messages and in logs CVE-2023-25163 Fix available 6.3 MediumFebruary 8, 2023
• argoproj argo-cd, argo cd +1 more argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled CVE-2023-22736 Fix available 8.6 HighJanuary 25, 2023
• argoproj argo cd, argo-cd +1 more JWT audience claim is not verified CVE-2023-22482 Fix available 9.1 CriticalJanuary 25, 2023
• argoproj argo cd, argo-cd +1 more Cross-site Scripting for Argo CD single sign on users CVE-2022-31102 Fix available 2.6 LowJuly 12, 2022
• argoproj argo cd, argo-cd +1 more Argo CD's certificate verification is skipped for connections to OIDC providers CVE-2022-31105 Fix available 8.3 HighJuly 12, 2022
• argoproj argo cd, argo-cd +1 more Argo CD vulnerable to Uncontrolled Memory Consumption CVE-2022-31016 Fix available 6.5 MediumJune 21, 2022
• argoproj argo cd, argo-cd +1 more Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server CVE-2022-31036 Fix available 4.3 MediumJune 21, 2022
• argoproj argo-cd, argo cd +1 more External URLs for Deployments can include javascript in argo-cd CVE-2022-31035 Fix available 9.0 CriticalJune 21, 2022
• argoproj argo-cd, argo cd +1 more Insecure entropy in argo-cd CVE-2022-31034 Fix available 8.3 HighJune 21, 2022
• argoproj argo cd, argo-cd +1 more Argo CD will blindly trust JWT claims if anonymous access is enabled CVE-2022-29165 Fix available 10.0 CriticalMay 20, 2022
• argoproj argo cd, argo-cd +1 more Argo CD login screen allows message spoofing if SSO is enabled CVE-2022-24905 Fix available 4.3 MediumMay 20, 2022
• argoproj argo cd, argo-cd +1 more Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server CVE-2022-24904 Fix available 4.3 MediumMay 20, 2022
• argoproj argo cd, argo-cd +1 more Improper access control allows admin privilege escalation in Argo CD CVE-2022-24768 Fix available 9.9 CriticalMarch 23, 2022
• argoproj argo cd, argo-cd +1 more Path traversal allows leaking out-of-bound files from Argo CD repo-server CVE-2022-24731 Fix available 6.8 MediumMarch 23, 2022
• argoproj argo cd, argo-cd +1 more Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server CVE-2022-24730 Fix available 7.7 HighMarch 23, 2022