Skip to content
Argoproj Argo Cd vulnerabilities
-
argoproj argo cd, argo-cd +1 more
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
CVE-2026-45738
Fix available
7.3 High
-
argoproj argo cd, argo-cd +1 more
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
CVE-2026-45737
Fix available
6.3 Medium
-
argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 more
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
CVE-2026-42880
Public exploitFix available
9.6 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
CVE-2025-59538
Fix available
EPSS 10.6%
7.5 High
-
argoproj argo-cd, argo cd +1 more
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
CVE-2025-59537
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
CVE-2025-59531
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Repository Credentials Race Condition Crashes Argo CD Server
CVE-2025-55191
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD: Project API Token Exposes Repository Credentials
CVE-2025-55190
Fix available
10.0 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD allows cross-site scripting on repositories page
CVE-2025-47933
Fix available
9.1 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD does not scrub secret values from patch errors
CVE-2025-23216
Fix available
6.8 Medium
-
argoproj argo cd, argo-cd +1 more
The Argo CD web terminal session does not handle the revocation of user permissions properly.
CVE-2024-41666
Fix available
4.7 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
CVE-2024-40634
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Unauthenticated Access to sensitive settings in Argo CD
CVE-2024-37152
Fix available
5.3 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD allows authenticated users to enumerate clusters by name
CVE-2024-36106
Fix available
4.3 Medium
-
argoproj argo cd, argo-cd +1 more
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
CVE-2024-31989
Public exploitFix available
9.1 Critical
-
argoproj argo cd, argo-cd +1 more
Denial of Service via malicious jqPathExpressions in ignoreDifferences
CVE-2024-32476
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD' API server does not enforce project sourceNamespaces
CVE-2024-31990
Fix available
4.8 Medium
-
argoproj argo cd, argo-cd +1 more
Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
CVE-2024-29893
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
CVE-2024-21661
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow
CVE-2024-21662
Fix available
7.5 High
-
argoproj argo cd, argo-cd +1 more
Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
CVE-2024-21652
Fix available
9.8 Critical
-
argoproj argo-cd, argo cd +1 more
Users with `create` but not `override` privileges can perform local sync in argo-cd
CVE-2023-50726
Fix available
6.4 Medium
-
argoproj argo-cd, argo cd +1 more
Cross-site scripting on application summary component in argo-cd
CVE-2024-28175
Fix available
9.1 Critical
-
argoproj argo-cd, argo cd +1 more
Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd
CVE-2024-22424
Fix available
8.4 High
-
argoproj argo cd, argo-cd +1 more
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
CVE-2023-40026
Fix available
5.0 Medium
-
argoproj argo cd, argo-cd +1 more
Denial of Service to Argo CD repo-server
CVE-2023-40584
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Cluster secret might leak in cluster details page in Argo CD
CVE-2023-40029
Public exploitFix available
9.9 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD web terminal session doesn't expire
CVE-2023-40025
Fix available
4.7 Medium
-
argoproj argo cd, argo-cd +1 more
Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets
CVE-2023-23947
Fix available
9.1 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD leaks repository credentials in user-facing error messages and in logs
CVE-2023-25163
Fix available
6.3 Medium
-
argoproj argo-cd, argo cd +1 more
argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled
CVE-2023-22736
Fix available
8.6 High
-
argoproj argo cd, argo-cd +1 more
JWT audience claim is not verified
CVE-2023-22482
Fix available
9.1 Critical
-
argoproj argo cd, argo-cd +1 more
Cross-site Scripting for Argo CD single sign on users
CVE-2022-31102
Fix available
2.6 Low
-
argoproj argo cd, argo-cd +1 more
Argo CD's certificate verification is skipped for connections to OIDC providers
CVE-2022-31105
Fix available
8.3 High
-
argoproj argo cd, argo-cd +1 more
Argo CD vulnerable to Uncontrolled Memory Consumption
CVE-2022-31016
Fix available
6.5 Medium
-
argoproj argo cd, argo-cd +1 more
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
CVE-2022-31036
Fix available
4.3 Medium
-
argoproj argo-cd, argo cd +1 more
External URLs for Deployments can include javascript in argo-cd
CVE-2022-31035
Fix available
9.0 Critical
-
argoproj argo-cd, argo cd +1 more
Insecure entropy in argo-cd
CVE-2022-31034
Fix available
8.3 High
-
argoproj argo cd, argo-cd +1 more
Argo CD will blindly trust JWT claims if anonymous access is enabled
CVE-2022-29165
Fix available
10.0 Critical
-
argoproj argo cd, argo-cd +1 more
Argo CD login screen allows message spoofing if SSO is enabled
CVE-2022-24905
Fix available
4.3 Medium
-
argoproj argo cd, argo-cd +1 more
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
CVE-2022-24904
Fix available
4.3 Medium
-
argoproj argo cd, argo-cd +1 more
Improper access control allows admin privilege escalation in Argo CD
CVE-2022-24768
Fix available
9.9 Critical
-
argoproj argo cd
Argo CD improper access control bug can allow malicious user to escalate privileges to admin level
CVE-2022-1025
Fix available
8.8 High
-
argoproj argo cd, argo-cd +1 more
Path traversal allows leaking out-of-bound files from Argo CD repo-server
CVE-2022-24731
Fix available
6.8 Medium
-
argoproj argo cd, argo-cd +1 more
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
CVE-2022-24730
Fix available
7.7 High
-
argoproj argo cd, redhat openshift gitops +1 more
A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and...
CVE-2021-3557
6.5 Medium
-
argoproj argo cd
Path traversal and dereference of symlinks in Argo CD
CVE-2022-24348
Public exploitFix available
7.7 High
-
argo cd cd, argoproj argo cd +1 more
Argo CD leaked secret data into error messages and logs on invalid edits via UI
CVE-2021-23135
Fix available
5.9 Medium
-
argoproj argo cd
An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.
CVE-2021-26924
6.1 Medium
-
argoproj argo cd
An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication.
CVE-2021-26923
7.5 High
- Show olderLoading…