github.com/argoproj/argo-cd
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- affected by 25 advisory(ies)
Advisories (82)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2f5v-8r3f-8pww Improper access control allows admin privilege escalation in Argo CD | 0.5.0 – < 2.1.14 ; 2.2.0 – < 2.2.8 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-2hj5-g64g-fp6p Argo CD allows cross-site scripting on repositories page | 1.2.0-rc1 – 1.8.7 | Undetermined |
| GHSA-2m7h-86qq-fp4v Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params | 0.11.0 – < 2.1.16 | Undetermined |
| GHSA-2q5c-qw9c-fmvq Argo CD authenticated but unauthorized users may enumerate Application names via the API | 0.5.0 – 1.8.7 | Undetermined |
| GHSA-3cqf-953p-h5cp Argo-cd authenticated users can enumerate clusters by name | 0.11.0 – < 2.9.17 ; 2.10.0 – < 2.10.12 ; 2.11.0 – < 2.11.3 | Undetermined |
| GHSA-3jfq-742w-xg8j Users with any cluster secret update access may update out-of-bounds cluster secrets | 2.3.0 – < 2.3.17 ; 2.4.0 – < 2.4.23 ; 2.5.0 – < 2.5.11 ; … | Undetermined |
| GHSA-47g2-qmh2-749v Argo CD does not scrub secret values from patch errors | ≤ 1.8.7 | Undetermined |
| GHSA-63qx-x74g-jcr7 Path traversal and dereference of symlinks in Argo CD | < 2.1.9 | Undetermined |
| GHSA-6jqw-jwf5-rp8h Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server | ≤ 1.8.7 | Undetermined |
| GHSA-6v85-wr92-q4p7 Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment | ≤ 1.8.7 | Undetermined |
| GHSA-6w87-g839-9wv7 Helm OCI credentials leaked into Argo CD logs | < 1.7.14 ; 1.8.0 – < 1.8.7 | Undetermined |
| GHSA-7943-82jg-wmw5 Argo CD certificate verification is skipped for connections to OIDC providers | 0.4.0 – < 2.2.11 ; 2.3.0 – < 2.3.6 ; 2.4.0 – < 2.4.5 | Undetermined |
| GHSA-92mw-q256-5vwg github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability | 0.1.0 – 1.8.7 | Undetermined |
| GHSA-96jv-vj39-x4j6 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level | 0.5.0 – 1.8.7 | Undetermined |
| GHSA-9766-5277-j5hr ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache | ≤ 1.8.7 | Undetermined |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload | 1.2.0 – 1.8.7 | Undetermined |
| GHSA-g623-jcgg-mhmm Users with `create` but not `override` privileges can perform local sync | 1.2.0-rc1 – 1.8.7 | Undetermined |
| GHSA-h4w9-6x78-8vrj Argo CD's external URLs for Deployments can include JavaScript | 1.0.0 – < 2.1.16 | Undetermined |
| GHSA-h6h5-6fmq-rh28 Path traversal allows leaking out-of-bound files from Argo CD repo-server | 1.5.0 – < 2.1.11 ; 2.2.0 – < 2.2.6 ; 2.3.0-rc1 – < 2.3.0 | Undetermined |
| GHSA-h8jc-jmrf-9h8f Argo CD Insecure default administrative password | ≤ 1.8.0 | Undetermined |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | ≤ 1.8.7 | Undetermined |
| GHSA-jhqp-vf4w-rpwq DoS through large manifest files in Argo CD | 0.7.0 – < 2.1.16 | Undetermined |
| GHSA-jmvp-698c-4x3w Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint | 1.0.0 – 1.8.7 | Undetermined |
| GHSA-jwv5-8mqv-g387 Cross-site scripting on application summary component | 1.0.0 – 1.8.7 | Undetermined |
| GHSA-pmjg-52h9-72qv Argo CD SSO users vulnerable to Cross-site Scripting | 2.3.0 – < 2.3.6 ; 2.4.0 – < 2.4.5 | Undetermined |
| GHSA-q4w5-4gq2-98vm Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server | 1.3.0 – < 2.1.16 | Undetermined |
| GHSA-q9hr-j4rf-8fjc JWT audience claim is not verified | 1.8.2 – < 2.3.14 ; 2.4.0 – < 2.4.20 ; 2.5.0 – < 2.5.8 ; … | Undetermined |
| GHSA-r642-gv9p-2wjj Argo CD will blindly trust JWT claims if anonymous access is enabled | < 2.1.15 | Undetermined |
| GHSA-r9cr-hvjj-496v Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server | 1.3.0 – < 2.1.11 ; 2.2.0 – < 2.2.6 ; 2.3.0-rc1 – < 2.3.0 | Undetermined |
| GHSA-vj54-cjrx-x696 Observable Discrepancy in Argo | 1.5.0 – < 1.5.1 | Undetermined |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload | 1.2.0 – 1.8.7 | Undetermined |
| GHSA-xcqr-9h24-vrgw Improper Restriction of Excessive Authentication Attempts in Argo API | < 1.5.1 | Undetermined |
| GHSA-xj7v-c82w-92q2 Argo Exposure of Sensitive Information | < 1.5.0-rc1 | Undetermined |
| GHSA-xmg8-99r8-jc2j Login screen allows message spoofing if SSO is enabled | < 2.1.15 | Undetermined |
| GO-2022-0304 Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd | * | Affected |
| GO-2022-0357 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd | ≥ 1.3.0 | Undetermined |
| GO-2022-0358 Path traversal allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd | ≥ 1.5.0 | Undetermined |
| GO-2022-0359 Improper access control allows admin privilege escalation in Argo CD in github.com/argoproj/argo-cd | ≥ 0.5.0 | Undetermined |
| GO-2022-0387 Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd | < 1.7.14 ; 1.8.0 – < 1.8.7 | Undetermined |
| GO-2022-0453 Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd | * | Affected |
| GO-2022-0454 Login screen allows message spoofing if SSO is enabled in github.com/argoproj/argo-cd | * | Affected |
| GO-2022-0455 Argo CD will blindly trust JWT claims if anonymous access is enabled in github.com/argoproj/argo-cd | * | Affected |
| GO-2022-0495 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd | ≥ 0.7.0 | Undetermined |
| GO-2022-0497 Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params in github.com/argoproj/argo-cd | ≥ 0.11.0 | Undetermined |
| GO-2022-0498 Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd | ≥ 1.0.0 | Undetermined |
| GO-2022-0499 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd | ≥ 1.3.0 | Undetermined |
| GO-2022-0516 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd | ≥ 0.5.0 | Undetermined |
| GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd | * | Affected |
| GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd | ≥ 0.4.0 | Undetermined |
| GO-2022-0869 Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd | < 1.7.13 ; 1.8.0 – < 1.8.6 | Undetermined |
| GO-2022-0882 Observable Discrepancy in Argo in github.com/argoproj/argo-cd | 1.5.0 – < 1.5.1 | Undetermined |
| GO-2022-0892 Improper Restriction of Excessive Authentication Attempts in Argo API in github.com/argoproj/argo-cd | < 1.5.1 | Undetermined |
| GO-2023-1512 Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd | * | Affected |
| GO-2023-1520 JWT audience claim is not verified in github.com/argoproj/argo-cd | ≥ 1.8.2 | Undetermined |
| GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets in github.com/argoproj/argo-cd | * | Affected |
| GO-2023-1670 Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd | ≥ 0.5.0 | Undetermined |
| GO-2023-1952 Argo Exposure of Sensitive Information in github.com/argoproj/argo-cd | < 1.5.0-rc1 | Undetermined |
| GO-2023-2018 Argo CD web terminal session doesn't expire in github.com/argoproj/argo-cd | * | Affected |
| GO-2023-2049 Argo CD cluster secret might leak in cluster details page in github.com/argoproj/argo-cd | * | Affected |
| GO-2023-2050 Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd | * | Affected |
| GO-2023-2085 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server in github.com/argoproj/argo-cd | * | Affected |
| GO-2024-2643 Bypass manifest during application creation in github.com/argoproj/argo-cd/v2 | ≥ 1.2.0-rc1 | Undetermined |
| GO-2024-2646 Cross-site scripting on application summary component in github.com/argoproj/argo-cd/v2 | ≥ 1.0.0 | Undetermined |
| GO-2024-2728 Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd | * | Affected |
| GO-2024-2792 Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd | * | Affected |
| GO-2024-2877 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd | * | Affected |
| GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd | ≥ 0.11.0 | Undetermined |
| GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd | * | Affected |
| GO-2024-3002 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd | ≥ 1.0.0 | Undetermined |
| GO-2024-3006 The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd | * | Affected |
| GO-2025-3433 Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd | * | Affected |
| GO-2025-3720 Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd | ≥ 1.2.0-rc1 | Undetermined |
| GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd | * | Affected |
| GO-2025-3993 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd | ≥ 1.2.0 | Undetermined |
| GO-2025-3994 Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd | * | Affected |
| GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd | * | Affected |
| GO-2025-3996 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd | ≥ 1.2.0 | Undetermined |
| GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd | * | Affected |
| GO-2026-5418 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd | * | Affected |
| GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd | * | Affected |
| GO-2026-6701 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd | * | Affected |
| GO-2026-6784 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd | * | Affected |
Sources
| Source | Licence |
|---|