argoproj argo-cd
50 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-113709 | >= 2.1.0, < 3.3.15 ; >= 3.4.0-rc1, < 3.4.10 ; >= 3.5.0-rc1, < 3.5.4 ; … | Argo CD: A Kustomize Helm config home can run commands in the repo-server | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-113708 | >= 2.7.0, < 3.3.15 ; >= 3.4.0-rc1, < 3.4.10 ; >= 3.5.0-rc1, < 3.5.4 ; … | Argo CD: A Kustomize remote ref can run commands in the repo-server | CRITICAL 9.9 | 0.7 % | ||
| CVE-2026-113672 | >= 0.9.0, < 3.3.1 ; >= 3.4.0-rc1, < 3.4.10 ; >= 3.5.0-rc1, < 3.5.4 ; … | Argo CD: A Jsonnet import can read files from the repo-server | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-77459 | >= 2.10.0, <= 2.14.21 ; >= 3.0.0, < 3.3.15 ; >= 3.4.0, < 3.4.10 ; … | Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-55797 | >= 2.11.0, <= 2.14.21 ; >= 3.0.0, < 3.3.15 ; >= 3.4.0, < 3.4.10 ; … | Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL | HIGH 8.8 | 1.9 % | ||
| CVE-2026-45737 | >= 3.2.0, < 3.2.12 ; >= 3.3.9, < 3.3.10 ; >= 3.4.1, < 3.4.2 | Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-45738 | < 3.2.12 ; >= 3.3.0, < 3.3.10 ; >= 3.4.0-rc1, < 3.4.2 | Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | HIGH 8.7 | 0.6 % | ||
| CVE-2026-42880 | >= 3.2.0, < 3.2.11 ; >= 3.3.0, < 3.3.9 | ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction | CRITICAL 9.6 | 0.6 % | ||
| CVE-2026-43824 | 3.2.0 – < 3.2.11 ; 3.3.0 – < 3.3.9 | In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. | CRITICAL 9.6 | 0.3 % | ||
| CVE-2025-59538 | >= 2.9.0-rc1, < 2.14.20 ; >= 3.2.0-rc1, < 3.2.0-rc2 ; >= 3.1.0-rc1, < 3.1.8 ; … | Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook | HIGH 7.5 | 9.4 % | ||
| CVE-2025-59537 | >= 1.2.0, <= 1.8.7 ; >= 2.0.0-rc1, < 2.14.20 ; >= 3.2.0-rc1, < 3.2.0-rc2 ; … | argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload | HIGH 7.5 | 0.6 % | ||
| CVE-2025-59531 | >= 1.2.0, <= 1.8.7 ; >= 2.0.0-rc1, < 2.14.20 ; >= 3.2.0-rc1, < 3.2.0-rc2 ; … | Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload | HIGH 7.5 | 0.6 % | ||
| CVE-2025-55191 | >= 2.1.0, < 2.14.20 ; = 3.2.0-rc1 ; >= 3.1.0-rc1, < 3.1.8 ; … | Repository Credentials Race Condition Crashes Argo CD Server | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-55190 | >= 2.13.0, < 2.13.9 ; >= 2.14.0, < 2.14.16 ; >= 3.0.0, < 3.0.14 ; … | Argo CD: Project API Token Exposes Repository Credentials | CRITICAL 10.0 | 5.7 % | ||
| CVE-2025-47933 | >= 1.2.0-rc1, <= 1.8.7 ; >= 2.0.0-rc3, < 2.13.8 ; >= 2.14.0-rc1, < 2.14.13 ; … | Argo CD allows cross-site scripting on repositories page | CRITICAL 9.1 | 0.5 % | ||
| CVE-2025-23216 | >= 2.13.0, < 2.13.4 ; >= 2.12.0, < 2.12.10 ; < 2.11.13 | Argo CD does not scrub secret values from patch errors | MEDIUM 6.8 | 0.5 % | ||
| CVE-2024-41666 | >= 2.6.0, < 2.9.21 ; >= 2.10.0, < 2.10.16 ; >= 2.11.0, < 2.11.7 | The Argo CD web terminal session does not handle the revocation of user permissions properly. | MEDIUM 6.5 | 0.7 % | ||
| CVE-2024-40634 | >= 1.0.0, < 2.9.20 ; >= 2.10.0, < 2.10.15 ; >= 2.11.0, < 2.11.6 | Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint | HIGH 7.5 | 1.4 % | ||
| CVE-2024-37152 | >= 2.9.3, < 2.9.17 ; >= 2.10.0, < 2.10.12 ; >= 2.11.0, < 2.11.3 | Unauthenticated Access to sensitive settings in Argo CD | HIGH 7.5 | 2.3 % | ||
| CVE-2024-36106 | > 0.11.0, < 2.9.17 ; >= 2.10.0, < 2.10.12 ; >= 2.11.0, < 2.11.3 | Argo CD allows authenticated users to enumerate clusters by name | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-31989 | < 2.8.19 ; >= 2.9.0-rc1, < 2.9.15 ; >= 2.10.0-rc1, < 2.10.10 ; … | ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache | CRITICAL 9.1 | 1.5 % | ||
| CVE-2024-32476 | >= 2.10.0, < 2.10.8 ; >= 2.9.0, < 2.9.13 ; < 2.8.17 | Denial of Service via malicious jqPathExpressions in ignoreDifferences | MEDIUM 6.5 | 1.0 % | ||
| CVE-2024-31990 | >= 2.10.0, < 2.10.7 ; >= 2.9.0, < 2.9.12 ; >= 2.4.0, < 2.8.16 | Argo CD' API server does not enforce project sourceNamespaces | MEDIUM 6.3 | 0.4 % | ||
| CVE-2024-29893 | >= 2.4.0, < 2.8.14 ; >= 2.9.0, < 2.9.10 ; >= 2.10.0, < 2.10.5 | Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server | MEDIUM 6.5 | 1.0 % | ||
| CVE-2024-21662 | < 2.8.13 ; >= 2.9.0, < 2.9.9 ; >= 2.10.0, < 2.10.4 | Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow | CRITICAL 9.1 | 0.8 % | ||
| CVE-2024-21661 | < 2.8.13 ; >= 2.9.0, < 2.9.9 ; >= 2.10.0, < 2.10.4 | Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment | HIGH 7.5 | 1.2 % | ||
| CVE-2024-21652 | < 2.8.13 ; >= 2.9.0, < 2.9.9 ; >= 2.10.0, < 2.10.4 | Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss | CRITICAL 9.8 | 0.8 % | ||
| CVE-2023-50726 | >= 1.2.0-rc1, < 2.8.12 ; >= 2.9.0, < 2.9.8 ; >= 2.10.0, < 2.10.3 | Users with `create` but not `override` privileges can perform local sync in argo-cd | MEDIUM 6.4 | 0.5 % | ||
| CVE-2024-28175 | >= 1.0.0, < 2.8.12 ; >= 2.9.0, < 2.9.8 ; >= 2.10.0, < 2.10.3 | Cross-site scripting on application summary component in argo-cd | CRITICAL 9.1 | 0.7 % | ||
| CVE-2024-22424 | >= 0.1.0, < 2.7.15 ; >= 2.8.0, < 2.8.8 ; >= 2.9.0, < 2.9.4 ; … | Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd | HIGH 8.4 | 0.5 % | ||
| CVE-2023-40026 | < 2.3 | Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server | MEDIUM 5.0 | 0.6 % | ||
| CVE-2023-40584 | >= 2.4.0, < 2.6.15 ; >= 2.7.0, < 2.7.14 ; >= 2.8.0, < 2.8.3 | Denial of Service to Argo CD repo-server | MEDIUM 6.5 | 1.4 % | ||
| CVE-2023-40029 | >= 2.2.0, < 2.6.15 ; >= 2.7.0, < 2.7.14 ; >= 2.8.0, < 2.8.3 | Cluster secret might leak in cluster details page in Argo CD | CRITICAL 9.9 | 1.2 % | ||
| CVE-2023-40025 | >= 2.6.0, < 2.6.14 ; >= 2.7.0, < 2.7.12 ; = 2.8.0 | Argo CD web terminal session doesn't expire | HIGH 7.1 | 0.6 % | ||
| CVE-2023-23947 | >= 2.3.0-rc1, < 2.3.17 ; >= 2.4.0, < 2.4.23 ; >= 2.5.0, < 2.5.11 ; … | Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets | CRITICAL 9.1 | 0.7 % | ||
| CVE-2023-25163 | >= 2.6.0-rc1, < 2.6.1 | Argo CD leaks repository credentials in user-facing error messages and in logs | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-22736 | >= 2.5.0=rc1, < 2.5.8 ; = 2.6.0-rc4, < 2.6.0-rc5 | argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled | HIGH 8.6 | 0.8 % | ||
| CVE-2023-22482 | >= 1.8.2, < 2.3.13 ; >= 2.4.0-rc1, < 2.4.19 ; >= 2.5.0-rc1, < 2.5.6 ; … | JWT audience claim is not verified | CRITICAL 9.1 | 0.9 % | ||
| CVE-2022-31102 | >= 2.3.0, < 2.3.6 ; >= 2.4.0, < 2.4.5 | Cross-site Scripting for Argo CD single sign on users | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-31105 | >= 0.4.0, < 2.2.11 ; >= 2.3.0, < 2.3.6 ; >= 2.4.0, < 2.4.5 | Argo CD's certificate verification is skipped for connections to OIDC providers | CRITICAL 9.6 | 0.8 % | ||
| CVE-2022-31036 | >= 1.3.0, < 2.1.16 ; >= 2.2.0, < 2.2.10 ; >= 2.3.0, < 2.3.5 ; … | Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server | MEDIUM 4.3 | 0.9 % | ||
| CVE-2022-31035 | >= 1.0.0, < 2.1.16 ; >= 2.2.0, < 2.2.10 ; >= 2.3.0, < 2.3.5 ; … | External URLs for Deployments can include javascript in argo-cd | CRITICAL 9.0 | 1.0 % | ||
| CVE-2022-31034 | >= 0.11.0, < 2.1.16 ; >= 2.2.0, < 2.2.10 ; >= 2.3.0, < 2.3.5 ; … | Insecure entropy in argo-cd | HIGH 8.3 | 1.0 % | ||
| CVE-2022-31016 | >= 0.7.0, < 2.1.16 ; > 2.0.0, < 2.2.10 ; > 2.3.0, < 2.3.5 | Argo CD vulnerable to Uncontrolled Memory Consumption | MEDIUM 6.5 | 0.9 % | ||
| CVE-2022-29165 | >= 1.4.0, < 2.1.15 ; >= 2.2.0, < 2.2.9 ; >= 2.3.0, < 2.3.4 | Argo CD will blindly trust JWT claims if anonymous access is enabled | CRITICAL 10.0 | 2.1 % | ||
| CVE-2022-24905 | < 2.1.15 ; >= 2.2.0, < 2.2.9 ; >= 2.3.0, < 2.3.4 | Argo CD login screen allows message spoofing if SSO is enabled | MEDIUM 4.3 | 1.3 % | ||
| CVE-2022-24904 | >= 0.7.0, < 2.1.15 ; >= 2.2.0, < 2.2.9 ; >= 2.3.0, < 2.3.4 | Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server | MEDIUM 4.3 | 1.2 % | ||
| CVE-2022-24768 | >= 0.5.0, < 2.1.14 ; >= 2.2.0, < 2.2.8 ; >= 2.3.0, < 2.3.2 | Improper access control allows admin privilege escalation in Argo CD | CRITICAL 9.9 | 1.3 % | ||
| CVE-2022-24731 | >= 1.5.0, < 2.1.11 ; >= 2.2.0, < 2.2.6 ; >= 2.3.0-rc1, < 2.3.0 | Path traversal allows leaking out-of-bound files from Argo CD repo-server | MEDIUM 6.8 | 1.0 % | ||
| CVE-2022-24730 | >= 1.3.0, < 2.1.11 ; >= 2.2.0, < 2.2.6 ; >= 2.3.0-rc1, < 2.3.0 | Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server | HIGH 7.7 | 0.9 % |