github.com/argoproj/argo-cd/v2
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- affected by 3 advisory(ies)
Advisories (86)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2gvw-w6fj-7m3c Argo CD's API server does not enforce project sourceNamespaces | 2.4.0 – < 2.8.16 ; 2.9.0 – < 2.9.12 ; 2.10.0 – < 2.10.7 | Undetermined |
| GHSA-2hj5-g64g-fp6p Argo CD allows cross-site scripting on repositories page | 2.0.0-rc3 – < 2.13.8 ; 2.14.0-rc1 – < 2.14.13 | Undetermined |
| GHSA-2m7h-86qq-fp4v Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GHSA-2q5c-qw9c-fmvq Argo CD authenticated but unauthorized users may enumerate Application names via the API | 2.5.0 – < 2.5.16 ; 2.6.0 – < 2.6.7 ; < 2.4.28 | Undetermined |
| GHSA-2vgg-9h6w-m454 Bypassing Rate Limit and Brute Force Protection Using Cache Overflow | < 2.8.13 ; 2.9.0 – < 2.9.9 ; 2.10.0 – < 2.10.4 | Undetermined |
| GHSA-47g2-qmh2-749v Argo CD does not scrub secret values from patch errors | 2.13.0 – < 2.13.4 ; 2.12.0 – < 2.12.10 ; < 2.11.13 | Undetermined |
| GHSA-63qx-x74g-jcr7 Path traversal and dereference of symlinks in Argo CD | < 2.1.9 ; 2.2.0 – < 2.2.4 | Undetermined |
| GHSA-6gcg-hp2x-q54h Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server | < 2.1.15 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.4 | Undetermined |
| GHSA-6jqw-jwf5-rp8h Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server | < 2.3.0 | Undetermined |
| GHSA-6p4m-hw2h-6gmw Controller reconciles apps outside configured namespaces when sharding is enabled | 2.5.0-rc1 – < 2.5.8 ; 2.6.0-rc4 – < 2.6.0-rc5 | Undetermined |
| GHSA-6v85-wr92-q4p7 Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment | < 2.8.13 ; 2.9.0 – < 2.9.9 ; 2.10.0 – < 2.10.4 | Undetermined |
| GHSA-786q-9hcg-v9ff Argo CD's Project API Token Exposes Repository Credentials | 2.13.0 – < 2.13.9 ; 2.14.0 – < 2.14.16 | Undetermined |
| GHSA-92mw-q256-5vwg github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability | < 2.7.16 ; 2.8.0-rc1 – < 2.8.8 ; 2.9.0-rc1 – < 2.9.4 ; … | Undetermined |
| GHSA-96jv-vj39-x4j6 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level | < 2.1.14 ; 2.2.0 – < 2.2.8 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-9766-5277-j5hr ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache | < 2.8.19 ; 2.9.0-rc1 – < 2.9.15 ; 2.10.0-rc1 – < 2.10.10 ; … | Undetermined |
| GHSA-9m6p-x4h2-6frq Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences | 2.10.0 – < 2.10.8 ; 2.9.0 – < 2.9.13 ; < 2.8.17 | Undetermined |
| GHSA-c8xw-vjgf-94hr Argo CD web terminal session doesn't expire | 2.6.0 – < 2.6.14 ; 2.7.0 – < 2.7.12 ; 2.8.0 – < 2.8.1 ; … | Undetermined |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload | 2.0.0-rc1 – < 2.14.20 | Undetermined |
| GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks | 2.10.0 – 2.14.21 | Undetermined |
| GHSA-fwr2-64vr-xv9m Argo CD cluster secret might leak in cluster details page | 2.2.0 – < 2.6.15 ; 2.7.0 – < 2.7.14 ; 2.8.0 – < 2.8.3 | Undetermined |
| GHSA-g623-jcgg-mhmm Users with `create` but not `override` privileges can perform local sync | 2.9.0 – < 2.9.8 ; 2.10.0 – < 2.10.3 ; 2.0.0-rc3 – < 2.8.12 | Undetermined |
| GHSA-g687-f2gx-6wm8 Argo CD repo-server Denial of Service vulnerability | 2.4.0 – < 2.6.15 ; 2.7.0 – < 2.7.14 ; 2.8.0 – < 2.8.3 | Undetermined |
| GHSA-g88p-r42r-ppp9 Repository Credentials Race Condition Crashes Argo CD Server | 2.1.0 – < 2.14.20 | Undetermined |
| GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook | 2.9.0-rc1 – < 2.14.20 | Undetermined |
| GHSA-h4w9-6x78-8vrj Argo CD's external URLs for Deployments can include JavaScript | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | ≤ 2.14.21 | Undetermined |
| GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL | 2.11.0 – 2.14.21 | Undetermined |
| GHSA-jhqp-vf4w-rpwq DoS through large manifest files in Argo CD | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GHSA-jhwx-mhww-rgc3 ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability | 2.4.0 – < 2.8.14 ; 2.9.0 – < 2.9.10 ; 2.10.0 – < 2.10.5 | Undetermined |
| GHSA-jmvp-698c-4x3w Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint | < 2.9.20 ; 2.10.0 – < 2.10.15 ; 2.11.0 – < 2.11.6 | Undetermined |
| GHSA-jwv5-8mqv-g387 Cross-site scripting on application summary component | 2.9.0 – < 2.9.8 ; 2.10.0 – < 2.10.3 ; 2.0.0 – < 2.8.12 | Undetermined |
| GHSA-mv6w-j4xc-qpfw Argo CD leaks repository credentials in user-facing error messages and in logs | 2.6.0-rc1 – < 2.6.1 | Undetermined |
| GHSA-q4w5-4gq2-98vm Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GHSA-qq5v-f4c3-395c Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2 | < 1.7.13 ; 1.8.0 – < 1.8.6 | Undetermined |
| GHSA-r642-gv9p-2wjj Argo CD will blindly trust JWT claims if anonymous access is enabled | 2.3.0 – < 2.3.4 ; 2.2.0 – < 2.2.9 ; < 2.1.15 | Undetermined |
| GHSA-v8wx-v5jq-qhhw The Argo CD web terminal session does not handle the revocation of user permissions properly | 2.6.0 – < 2.9.21 ; 2.10.0 – < 2.10.16 ; 2.11.0 – < 2.11.7 | Undetermined |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload | 2.0.0-rc1 – < 2.14.20 | Undetermined |
| GHSA-x32m-mvfj-52xv Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss | < 2.8.13 ; 2.9.0 – < 2.9.9 ; 2.10.0 – < 2.10.4 | Undetermined |
| GHSA-xmg8-99r8-jc2j Login screen allows message spoofing if SSO is enabled | 2.3.0 – < 2.3.4 ; 2.2.0 – < 2.2.9 ; 2.0.0 – < 2.1.15 | Undetermined |
| GO-2022-0304 Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd | < 2.1.9 ; 2.2.0 – < 2.2.4 | Undetermined |
| GO-2022-0357 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd | < 2.1.11 ; 2.2.0 – < 2.2.6 ; 2.3.0-rc1 – < 2.3.0 | Undetermined |
| GO-2022-0358 Path traversal allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd | < 2.1.11 ; 2.2.0 – < 2.2.6 ; 2.3.0-rc1 – < 2.3.0 | Undetermined |
| GO-2022-0359 Improper access control allows admin privilege escalation in Argo CD in github.com/argoproj/argo-cd | < 2.1.14 ; 2.2.0 – < 2.2.8 ; 2.3.0 – < 2.3.2 | Undetermined |
| GO-2022-0453 Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd | < 2.1.15 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.4 | Undetermined |
| GO-2022-0454 Login screen allows message spoofing if SSO is enabled in github.com/argoproj/argo-cd | 2.0.0 – < 2.1.15 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.4 | Undetermined |
| GO-2022-0455 Argo CD will blindly trust JWT claims if anonymous access is enabled in github.com/argoproj/argo-cd | < 2.1.15 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.4 | Undetermined |
| GO-2022-0495 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GO-2022-0497 Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params in github.com/argoproj/argo-cd | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GO-2022-0498 Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GO-2022-0499 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd | < 2.1.16 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.5 ; … | Undetermined |
| GO-2022-0516 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd | < 2.1.14 ; 2.2.0 – < 2.2.8 ; 2.3.0 – < 2.3.2 | Undetermined |
| GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd | 2.3.0 – < 2.3.6 ; 2.4.0 – < 2.4.5 | Undetermined |
| GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd | < 2.2.11 ; 2.3.0 – < 2.3.6 ; 2.4.0 – < 2.4.5 | Undetermined |
| GO-2023-1512 Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd | 2.5.0-rc1 – < 2.5.8 ; 2.6.0-rc4 – < 2.6.0-rc5 | Undetermined |
| GO-2023-1520 JWT audience claim is not verified in github.com/argoproj/argo-cd | < 2.3.14 ; 2.4.0 – < 2.4.20 ; 2.5.0 – < 2.5.8 ; … | Undetermined |
| GO-2023-1548 Repository access credential leak in github.com/argoproj/argo-cd/v2 | 2.6.0-rc1 – < 2.6.1 | Undetermined |
| GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets in github.com/argoproj/argo-cd | 2.3.0 – < 2.3.17 ; 2.4.0 – < 2.4.23 ; 2.5.0 – < 2.5.11 ; … | Undetermined |
| GO-2023-1670 Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd | < 2.4.28 ; 2.5.0 – < 2.5.16 ; 2.6.0 – < 2.6.7 | Undetermined |
| GO-2023-2018 Argo CD web terminal session doesn't expire in github.com/argoproj/argo-cd | 2.6.0 – < 2.6.14 ; 2.7.0 – < 2.7.12 ; 2.8.0 – < 2.8.1 | Undetermined |
| GO-2023-2049 Argo CD cluster secret might leak in cluster details page in github.com/argoproj/argo-cd | 2.2.0 – < 2.6.15 ; 2.7.0 – < 2.7.14 ; 2.8.0 – < 2.8.3 | Undetermined |
| GO-2023-2050 Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd | 2.4.0 – < 2.6.15 ; 2.7.0 – < 2.7.14 ; 2.8.0 – < 2.8.3 | Undetermined |
| GO-2023-2085 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server in github.com/argoproj/argo-cd | < 2.3.0 | Undetermined |
| GO-2024-2643 Bypass manifest during application creation in github.com/argoproj/argo-cd/v2 | 2.0.0 – < 2.8.12 ; 2.9.0 – < 2.9.8 ; 2.10.0 – < 2.10.3 | Undetermined |
| GO-2024-2646 Cross-site scripting on application summary component in github.com/argoproj/argo-cd/v2 | 2.0.0 – < 2.8.12 ; 2.9.0 – < 2.9.8 ; 2.10.0 – < 2.10.3 | Undetermined |
| GO-2024-2652 Brute force protection bypass in github.com/argoproj/argo-cd/v2 | < 2.8.13 ; 2.9.0 – < 2.9.9 ; 2.10.0 – < 2.10.4 | Undetermined |
| GO-2024-2654 Denial of service in github.com/argoproj/argo-cd/v2 | < 2.8.13 ; 2.9.0 – < 2.9.9 ; 2.10.0 – < 2.10.4 | Undetermined |
| GO-2024-2667 Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2 | 2.4.0 – < 2.8.14 ; 2.9.0 – < 2.9.10 ; 2.10.0 – < 2.10.5 | Undetermined |
| GO-2024-2728 Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd | 2.4.0 – < 2.8.16 ; 2.9.0 – < 2.9.12 ; 2.10.0 – < 2.10.7 | Undetermined |
| GO-2024-2792 Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd | < 2.8.17 ; 2.9.0 – < 2.9.13 ; 2.10.0 – < 2.10.8 | Undetermined |
| GO-2024-2877 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd | < 2.8.19 ; 2.9.0-rc1 – < 2.9.15 ; 2.10.0-rc1 – < 2.10.10 ; … | Undetermined |
| GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd | < 2.9.17 ; 2.10.0 – < 2.10.12 ; 2.11.0 – < 2.11.3 | Undetermined |
| GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd | 2.9.3 – < 2.9.17 ; 2.10.0 – < 2.10.12 ; 2.11.0 – < 2.11.3 | Undetermined |
| GO-2024-3002 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd | < 2.9.20 ; 2.10.0 – < 2.10.15 ; 2.11.0 – < 2.11.6 | Undetermined |
| GO-2024-3006 The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd | 2.6.0 – < 2.9.21 ; 2.10.0 – < 2.10.16 ; 2.11.0 – < 2.11.7 | Undetermined |
| GO-2025-3433 Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd | < 2.11.13 ; 2.12.0 – < 2.12.10 ; 2.13.0 – < 2.13.4 | Undetermined |
| GO-2025-3720 Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd | 2.0.0-rc3 – < 2.13.8 ; 2.14.0-rc1 – < 2.14.13 | Undetermined |
| GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd | 2.13.0 – < 2.13.9 ; 2.14.0 – < 2.14.16 | Undetermined |
| GO-2025-3993 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd | < 2.14.20 | Undetermined |
| GO-2025-3994 Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd | 2.1.0 – < 2.14.20 | Undetermined |
| GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd | 2.9.0-rc1 – < 2.14.20 | Undetermined |
| GO-2025-3996 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd | < 2.14.20 | Undetermined |
| GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd | * | Affected |
| GO-2026-5418 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd | * | Affected |
| GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd | * | Affected |
| GO-2026-6701 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd | ≥ 2.11.0 | Undetermined |
| GO-2026-6784 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd | ≥ 2.10.0 | Undetermined |
Sources
| Source | Licence |
|---|